yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 Android Development] GeTex:
we have 11 toshiba devices. We have no firmware and no leaked vendors CMDS. I don't think you understand but without a firmware dump or leaked CMD's there no way to do this. You can't just probe them, it's not the same as commands in a terminal, it's hardware level commands in assembly and hexdecimal. It's not for toying around, one wrong command and you brick it

---------- Post added at 03:24 PM ---------- Previous post was at 03:19 PM ----------

we don't know any toshiba EMMC vendors CMD's for this device. the straightalk devices have an unlocked bootloader, we do not. We cannot even unlock the booloader without first figuring out how to allow our devices to accept unsigned tars which cannot be done unless we make our devices dev editions first, which also cannot be done till we find a CID to change to and also a matching aboot to make the modifications from...

Please DO NOT post here unless you understand what a CID is, how an eMMC works, how the dev edition devices work, how signatures work, how verizons bootloader works, and also what hardware level commands are. It's not helping us.

More news, as expected, toshiba was not exactly open to giving out vendor CMD's but they hinted that we can do a firmware dump via JTAG but t needs fiddiling as expected. Anyone wanna donate a 11 S5 that will likely not comeback. I'll use my hot air station to remove the chip and dig out my Riff box. We have a pinout for the chip so I know hot to connect it, now a matter f how do we dump the firmware?
[Verizon Galaxy S 5 Android Development] krazy_smokezalot:
So I have a Toshiba 11 gs5 i can spare so you guys can give it a shot but you said we can't post here if I Don't know about bootloarder, cid, eMMC!
[Verizon Galaxy S 5 Android Development] GeTex:
did you not read anything?

This is an R&D THREAD ONLY. Only those that know somehting or know what they are doing should be posting here. I have a Toshiba 11 Device as well, however whatever device i use to do this will be DESTROYED in the process. The eMMC will be rendered useless. So we need An S5 to mutilate. On top of that, just having an S5 11 isn't helpful. ALot of us here have them.
[Verizon Galaxy S 5 Android Development] krazy_smokezalot:
So I can't just send you mine to demolish!?
[Verizon Galaxy S 5 Android Development] GeTex:
Well be honest with me, are you okay with sacrificing a full blown Galaxy S5? or does it have a busted screen or similar?
[Verizon Galaxy S 5 Android Development] doubleaykay:
If they're OK and willing I'd say take them up on the offer... obviously it is up to their discretion to ship it, but if they do then take advantage of that opportunity.
[Verizon Galaxy S 5 Android Development] krazy_smokezalot:
You see you an ass straight up bro. Just because you know certain stuff Dont mean you can single out people and tell them not to out. Dutch bag yes I have one I Dont care for it which was my effin point to my question does it need to be a dev edition or not simple yes or no and I'll ship geez see how ez that could have went but noooo I know it all. Send me ur info smh
[Verizon Galaxy S 5 Android Development] al50:
Laughing inside, but "bro", "douche bag" is a woman. Lol.
[Verizon Galaxy S 5 Android Development] GeTex:
Id like you to learn what the purpose of R&D threads are. if you are providing a device thats awesome, but we have so many who post here like cheerleaders and go "do we have an unlock" or similar and it's useless. I saw your post and thought you said you had a toshiba S5 and were willing to test and im like "rly?" im sorry, I have dyslexia. So after rereading i figured out you were willing to donate an S5

we get to many clueless and useless people here, also if you are going to be involve,d please learn what a cid is, what the dev aboot is and how it works and also how emmc's work, it will help you understand how much this sucks and why verizon needs a good kick in the balls for everything they've put us through, and to make matters worse once marshmallows pushed and everyone's phones upgrade, guess what? no more root= no more exploit :'(

We are tight on time
[Verizon Galaxy S 5 Android Development] krazy_smokezalot:
Lls exactly another way for me saying he acting like a little female dog. I'm just trying to help out here I have a nexus 6p I can care less for this s5 and rather give it up for development purpose
[Verizon Galaxy S 5 Android Development] GeTex:
You may have not understood, but al50 is telling you, I'm a girl.... >.>
[Verizon Galaxy S 5 Android Development] krazy_smokezalot:
Right on the ball but I personally Dont have time to learn I'm learning about Android N right now ?? for the 6p

So I'd rather just ship my board or the whole housing if needed just so you guys can give the figer to my carrier vzw lol and unlock this. They made me hate Samsung smh

Oh and next time before you assume people are noons or whatever check out there XDA track record meaning participation and thanks points usually tells a lot about the person. Anyways I wish you guys the best and if you manage to unlock the bootloarder without bricking my device that would be awesome and I would take it back if that happens I Dont see it happening but hell brick this bad boy if you have to I had my fun with the phone

---------- Post added at 07:32 PM ---------- Previous post was at 07:29 PM ----------

?? Epic fail ctfu nice to see a female on here yeah your the second "I" met on XDA
[Verizon Galaxy S 5 Android Development] Coldblackice:
Krazy, you are a champ! Round of applause for the donation!
[Verizon Galaxy S 5 Android Development] GeTex:
I'll get a hold o Autonomous and see where we can go from here, I have a riff box round here somewhere but i idk where
[Verizon Galaxy S 5 Android Development] krazy_smokezalot:
U know how to use the riff box!?
[Verizon Galaxy S 5 Android Development] GeTex:
Some of it
[Verizon Galaxy S 5 Android Development] Coldblackice:
Would it help if I jtag'ed an 11 and got a full dump?
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Don't know if I'll get flamed for saying this or not, but if I could get the full model # of the 11 eMMC chip I'd love to help research

EDIT: found it
[Verizon Galaxy S 5 Android Development] KaratemanTJ:
Would pulling the eMMC from an S4 be just as good? It's my understanding they use the same Toshiba chip. My guess is there would be more/cheaper parts floating around since it's older. Also, I don't have any JTAG tools, but I have access to hot air reflow tools and would be happy to pull a chip and send it to someone that does. Don't mean to clutter an R&D thread, so I hope this isn't taken that way.
[Verizon Galaxy S 5 Android Development] GeTex:
My BGA rework heater coil is busted. I may as you to try and pull the chip as I only have a hot air station left and its not my best work, also I need to dig it up...

We need a firmware dump which most of you cannot accomplish
[Verizon Galaxy S 5 Android Development] Hariiiii:
yes.
[Verizon Galaxy S 5 Android Development] GeTex:
One of you let me know if you can dump it
[Verizon Galaxy S 5 Android Development] doubleaykay:
See if we can get a dump from an S4 as well, in case firmware is different (I may be wrong about it being different, but it's worth a shot).
[Verizon Galaxy S 5 Android Development] GeTex:
Uhhh.... A S5 dump is needed, as we uhhhh.... Possibly cannot verify if an S4 dump is the same without an S5 dump?
[Verizon Galaxy S 5 Android Development] KaratemanTJ:
[MENTION=766721]ryanbg[/MENTION] Would the fw info you reversed help to clarify whether or not the S4 & S5 are running the same fw versions?

Also, do we know if there are potentially any other busses or JTAG pins running around in the reserved section of the eMMC pinout?
[Verizon Galaxy S 5 Android Development] ryanbg:
They're different, but I'd imagine the vendor command protocol is similar or identical. Also, eMMC dumps are absolutely worthless. We're trying to reverse the eMMC controller/firmware, not the phone's firmware. The Galaxy S5 doesn't have JTAG pads either.
[Verizon Galaxy S 5 Android Development] GeTex:
RyanBG I've been reffering to removing the eMMC via a BGA rework station and trying to locate the JTAG pins externally and then trying to rip the controller firmware via a Riff Box, is this not possible? I figured it is but I assume the secure chip has a method to stop this?
[Verizon Galaxy S 5 Android Development] doubleaykay:
I know, I meant in addition to the S5 one!
[Verizon Galaxy S 5 Android Development] cclem81:
Just checking into see if there's been anything new on this.
[Verizon Galaxy S 5 Android Development] ldeveraux:
Don't bump the thread. If someone has news, it will be posted, just be patient.
[Verizon Galaxy S 5 Android Development] doubleaykay:
Someone managed to extract the Qualcomm TrustZone KeyMaster key... just an FYI if this helps.

https://mobile.twitter.com/laginimaineb/status/737051964857561093
[Verizon Galaxy S 5 Android Development] GeTex:
[MENTION=766721]ryanbg[/MENTION] [MENTION=711482]beaups[/MENTION] [MENTION=4908448]autonomousperson[/MENTION]

Is that method of any actual use??? If it is this could be big in multiple ways but I am on mobile and cannot read it very well without headache
[Verizon Galaxy S 5 Android Development] beaups:
Useless.
[Verizon Galaxy S 5 Android Development] GeTex:
Thankyou very much!

Will continue as I'm waiting on the donor S5, also looking for my riffbox

Anyone here have a riffbox?
[Verizon Galaxy S 5 Android Development] ryanbg:
Irrelevant to bootloaders.
[Verizon Galaxy S 5 Android Development] GeTex:
Figured as much :(
[Verizon Galaxy S 5 Android Development] Coldblackice:
Not trying to be mean here, but from the looks of it, it appears the donor S5 would be more useful in the hands of someone like [MENTION=766721]ryanbg[/MENTION] or [MENTION=711482]beaups[/MENTION] :/
[Verizon Galaxy S 5 Android Development] al50:
I believe that is irrelevant to this R&D thread.
[Verizon Galaxy S 5 Android Development] ryanbg:
I have an S5, no worries. Don't have a whole lot of time to dedicate to this project unfortunately.
[Verizon Galaxy S 5 Android Development] ryanbg:
JTAG won't help you get eMMC firmware. The firmware isn't mapped to device memory, it has to come straight from the chip itself via vendor commands. Regardless, I don't think FW is what we need at this point.
[Verizon Galaxy S 5 Android Development] GeTex:
I swear someone told me that I am capable of pulling the firmware VIA A JTAG doing a complete dump, but if thats wrong, then ugh

this just got nasty, So I do need to kinda take the vendor commands from Toshiba

Can anyone here identify the chip in great detail then, I'll see what my connection can do
[Verizon Galaxy S 5 Android Development] DraconicSeed:
I hate to be a pain or irrelevant but is there a site that I can look at or read to learn more about the process? I know what having root and an unlocked bootloader would allow but I wanted to learn more about the process so as to maybe help. Thanks.
[Verizon Galaxy S 5 Android Development] GeTex:
Yes, I can help explain this if you would like. I'll do it tomorrow unless someone beats me

[MENTION=5209970]al50[/MENTION] [MENTION=4908448]autonomousperson[/MENTION]
[Verizon Galaxy S 5 Android Development] DraconicSeed:
That would be awesome, but I don't want to waste anyone's time. Is there a place online that I can just research it myself? I know there used to be a developers Wiki out there somewhere that explains all the terms and I was hoping this boot process and stuff but I can't seem to find it.
[Verizon Galaxy S 5 Android Development] cclem81:
I too would like to volunteer my time as well.
[Verizon Galaxy S 5 Android Development] gerryl432:
I'm looking into buying a riff box to learn. But unsure where to buy. I would contribute this for the project if u PM me what I need I addition to the box (server support, adapters, etc.)
[Verizon Galaxy S 5 Android Development] Clickbait:
This threads gotten kind of quiet. Anything significant happen?
[Verizon Galaxy S 5 Android Development] yossijoe:
Your username matches your comment:laugh:
[Verizon Galaxy S 5 Android Development] GeTex:
Do not bump

[MENTION=7283147]gerryl432[/MENTION] I can help you out with a riffbox from my guys, we have riff boxes some want to sell and I can't find mine but now we have info that even a JTAG may not save us :(
[Verizon Galaxy S 5 Android Development] KaratemanTJ:
In regard to dumping the eMMC FW via JTAG, obviously JTAGing the main CPU won't be of any particular use, but I think the assumption was that we could JTAG the eMMC controller itself. The pins aren't listed on the datasheet for the chip, so does anyone actually know if they exist?

Second, my understanding is that when booting a dev-edition it checks the CID of the eMMC chip to see if it matches the signature of the bootloader. Do we know exactly how this check works? For instance, would it be possible to exploit the external SD card? Are the internal and external "cards" on the same memory bus? If so, could we change the CID of the external card and fool it? Would it be possible to boot from the SD card with an altered CID similar to how the debrick images work?

I'm not holding my breath, but I figured it was worth asking.

Thanks!
[Verizon Galaxy S 5 Android Development] GeTex:
I do not believe so, however someone could "try" but your entire phone would be a pain to use, and slow
[Verizon Galaxy S 5 Android Development] Outbreak444:
Is there any other Samsung phones that we are aware of that use Toshiba emmc's?

Found this here, not sure how much of a help it is, if any.

http://dumpemmc.blogspot.com/search/label/Samsung

There's also this right here. Not sure if I'm reading correctly but someone has said it's a Toshiba emmc and the CID is also an 11 so it may help with dumping firmware if that is still a concern.

http://forum.gsmhosting.com/vbb/f67...inout-step-step-pictures-1724774/#post9955880
[Verizon Galaxy S 5 Android Development] GeTex:
... The CID header(first two) is the manufacturer. Every 11 is a Toshiba, every 15 is Samsung, ect
[Verizon Galaxy S 5 Android Development] Outbreak444:
True, but would it be likely that the argument's are the same? Along with the process of dumping the firmware?
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Almost certain a JTAG can't dump an eMMC's firmware. Remember superbrick? JTAG couldn't save those devices because it could only access the flash data, not the controller itself
[Verizon Galaxy S 5 Android Development] GeTex:
Your absolutely right... I forgot I tested that during superbrick. Well with that found out, I guess we need to probe vendor CMDS. Who want to blindly run them till it works and 99% chance superbrick your phone?
[Verizon Galaxy S 5 Android Development] Lightn1ng:
We're more likely to crack Verizon's signing key
[Verizon Galaxy S 5 Android Development] GeTex:
Tbh yeah, and that's also not happening

Please can someone identify the Toshiba chip so I can uhh... "Obtain" information from Toshiba via total dishonesty?
[Verizon Galaxy S 5 Android Development] Lightn1ng:
(Our chip is the THGBMHG7C1LBAIL I believe) <- from the OP, all I could find :P

Don't get into legal/job trouble for this... please...

and could you please quote people you're talking to so we get a notification...
[Verizon Galaxy S 5 Android Development] GeTex:
Sorry, mobile is a pain, I subscribe threads for notifications, quoting is hard on mobile, especially at UMTS speeds...

I won't get into legal issues but I am cutting the rope with Toshiba possibly(they weren't my fav company anyways!)
[Verizon Galaxy S 5 Android Development] Lightn1ng:
May as well go "out with a bang" :P
[Verizon Galaxy S 5 Android Development] GeTex:
Seeing what I can do!

Someone here wanna start bruteforcing the signature :P
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Maybe if we offer Verizon a cookie they'll give it to us
[Verizon Galaxy S 5 Android Development] GeTex:
Idk why they care so much, just makes everyone want to leave for other carriers
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Yeah I wonder if Verizon actually spends more money locking phones than they would loose if they unlocked them
[Verizon Galaxy S 5 Android Development] GeTex:
They have like 4 whole departments and a outsourced Indian/Chinese R&D team just for finding ways to prevent unlocks
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Could you maybe get me the locations of these departments?

I know somebody who can "take them out" for a fee.
[Verizon Galaxy S 5 Android Development] GeTex:
Let's try and stay on topic from now on
[Verizon Galaxy S 5 Android Development] Lightn1ng:
True I'll stop :silly:
[Verizon Galaxy S 5 Android Development] Clickbait:
Could this be of any use?

bit(.)ly/ 1Ygp3gN
[Verizon Galaxy S 5 Android Development] TioCareca:
Look at your name, i am not clicking that... [emoji23]
[Verizon Galaxy S 5 Android Development] Quigly:
Do you possibly have a source to this information? I'm not questioning your knowledge rather I'm wondering how much we're up against.

Also, I will have a lot of free time on my hands come the next couple months and was wondering if there was documentation on the SM-G900V's hardware that's needs more attention or just more readers in general.
[Verizon Galaxy S 5 Android Development] GeTex:
I actually was trying to be funny and joke, but Verizon seems pretty hardcore about blocking
[Verizon Galaxy S 5 Android Development] Jimmy4485:
Is there any hope guys?
[Verizon Galaxy S 5 Android Development] GeTex:
Do not bump R&D threads
[Verizon Galaxy S 5 Android Development] Lightn1ng:
If my understanding is correct, the whole point of an unlock is to run custom kernels, right?

Is there a way to simply run a kernel from a location other than boot.img? I don't know if I'm explaining this well, but maybe we could chain-load another kernel?
[Verizon Galaxy S 5 Android Development] GeTex:
I don't believe so since the boot.IMG checks against itself. You could run a VM maybe but then performance will be hurt bad. The boot.IMG runs a checksum against itself for modifications, idk how we would run a chainloaded kernel, our best bet would be to honestly get more knowlageable people on board
[Verizon Galaxy S 5 Android Development] doubleaykay:
That is what people are working on in the kexec thread... the idea is to load the stock kernel, and then have the system spawn a new (custom) one over it after checks are done, and then kill the initial one.
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Loading a new kernel should be easy, but how do you kill an old kernel?
[Verizon Galaxy S 5 Android Development] doubleaykay:
You'd think it's easy, but the kexec people are unable to get the logs after it crashes, leaving them with no understanding of why it crashes. And as for killing the old kernel, I think you just force it out of memory... might be a part of kexec
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Interesting. I didn't think they'd gotten past the research stage.
[Verizon Galaxy S 5 Android Development] doubleaykay:
They sure did, they got pretty far actually... here is the thread: http://xdaforums.com/showthread.php?t=2500826
[Verizon Galaxy S 5 Android Development] GeTex:
There's some more surprises left that block trying to load a custom kernel afterwards, especially Knox existent in the bootloader. Yes KNOX exists in the bootloader. As far as I understand it isn't possible without Knox seeing that as a security violation but I'd have to look into this again

I can't remember much or think clearly. But the kexec method shouldn't be possible
[Verizon Galaxy S 5 Android Development] Lightn1ng:
I believe the entire chainloading process happens after the bootloader has finishes its job
[Verizon Galaxy S 5 Android Development] GeTex:
as far as i recall it never truly stops doing its job though, Samsung has made a real PITA with the whole thing to create an impenetrable fortress
[Verizon Galaxy S 5 Android Development] Lightn1ng:
When there is a will there is a way.
[Verizon Galaxy S 5 Android Development] blair.sadewitz:
If this is inappropriate, just delete it.

I found some company in Myanmar that will replace the emmc.

www.beyondservices.com.my

https://www.youtube.com/watch?v=AG4pNOBhttps://www.youtube.com/watch?v=AG4pNOBNqGcNqGc

www.beyondservices.com.my

Just a heads up. I have no affiliation with them, nor any knowledge of how competent they are, but when I have the cash, I think I'll be tempted to make an inquiry.
[Verizon Galaxy S 5 Android Development] GeTex:
I'd rather just use my BGA rework station and do it myself. Even so the chip needs to be preloaded or you need an sdcard with a bootloader or you won't be getting to download mode
[Verizon Galaxy S 5 Android Development] blair.sadewitz:
Hah, I'm not competent at that task, haha. I've got that sdcard in a box in my closet somewhere.

You know anything about QFIL or that msm8974 download tool? I have tried to find documentation to create images just for the hell of it, but I cant.

Anytime you feel like reworking a BGA, let me know--presuming the mortality rate is low enough ;)

I've had it with this horse hockey.

---------- Post added at 05:55 AM ---------- Previous post was at 05:46 AM ----------

What I've been wondering is if you could just corrupt the emmc and load whatever you want using lower-level tools. I figured no one ever did th is because it doesn't work for our purposes, heh.
[Verizon Galaxy S 5 Android Development] GeTex:
Not an issue of loading, the bootloader checks the CID at boot time and if it mismatches, it doesn't boot. Ever dev device has its own bootloader. Its not a dev bootloader and a consumer bootloader. Its a consumer bootloader and device 0, device 1... Device 7493. And none of them can be interchanged. I could do a BGA rework as I even have preflashed S5 Samsung Emmcs at my disposal. Would be fun to see, but until I fix my heater, I don't wanna. Also in a bad position so I don't have the time :(
[Verizon Galaxy S 5 Android Development] Surge1223:
Knox is just checking if the kernel is enforcing or Permissive and or if the kernel is not signed, and then gives the warranty void and blocks booting. The idea is to load the kernel after the aboot via kexec or to reboot from a specified address that contains the kernel machine code instructing the boot Process (hardboot). Neither of these methods of loading a custom kernel will have to deal with bootloader restrictions.

Well, more so than that, we know hashcode was able to correctly get the kernel identity mapped since he had serial uart output. This was years ago though, so don't bother him about it lol. I haven't been working on it since, I don't even use my s4 but I think it's a very likely achievable goal. It just requires some knowledge about Linux kernel boot process on arm.
[Verizon Galaxy S 5 Android Development] Lightn1ng:
deleted
[Verizon Galaxy S 5 Android Development] Lightn1ng:
Maybe we could look at the Little Kernel bootloader source? More the source for how the "fastboot boot" command works on other Qualcomm devices? (Maybe a zip flashable zip from safestrap to boot a Kernel?)
[Verizon Galaxy S 5 Android Development] Barabba11:
deleted
[Verizon Galaxy S 5 Android Development] sean19661:
There is an app on playstore called emmc bug brick will tell you your Cid if it's starts with 11 or 15
[Verizon Galaxy S 5 Android Development] Stupifier:
This is an R&D Thread to investigate how to Unlock CID 11 bootloader. Posts should be strictly related to how to do this. You should not be posting this stuff here. These type of posts belong in other threads.

Root for 6.0+ ROM on a CID 11 is NOT CURRENTLY POSSIBLE. And just to be clear, Unlocking Bootloader for CID 11 is Also NOT CURRENT POSSIBLE.
[Verizon Galaxy S 5 Android Development] GeTex:
This is not a guide, this is not a place to discuss what you want to discuss, this thread is only for developing a way to unlock the GS5 bootloader for 11 eMMC's
[Verizon Galaxy S 5 Android Development] Hariiiii:
This is on an old phone, but perhaps some of the information about implementing kexec here might be useful:

http://xdaforums.com/showthread.php?t=1266827

Edit: it looks like the key factor is finding out if the galaxy s5 hardware drivers support a soft-reboot.