[Verizon Galaxy Note 4 General] npjohnson:
All,

Due to the recent accidental leak of Samsung eMMC vendor commands allowing write to protected eMMC areas, we are now able to write CID values on production devices.

[MENTION=711482]beaups[/MENTION] has written an awesome tool called 'SamsungCID' (found here: https://github.com/beaups/SamsungCID). This tool is based off the research of [MENTION=766721]ryanbg[/MENTION] . This makes the process all the simpler for developers to understand/port functionality!

I have built this tool from his source, and used it on a multitude of devices that use a Samsung eMMC. It works without flaw on the Moto G (Second Generation), Galaxy S5 (VZW/ATT, though, ATT doesn't have a Developer Edition that I am aware of, though, it still could work, I need a tester, PM me, or Telegram me [MENTION=5848265]npjohnson[/MENTION]), and many, many other devices form a variety of manufacturers..

How does this apply to you?

The Note 4 uses a Samsung eMMC, and has a Developer Edition. This means that it is vulnerable to this exploit.

How can you help this progress?

You can't.

Currently, the CID writes 'successfully', and persists across reboots, but one of the registers isn't fully flushed. I am working on a module that will flush the register and allow for the Developer Edition Aboot to be flashed via ODIN.

Now, you may ask "How could we load modules, I thought that was impossible?", the short answer is, it is. At least, without what we found (or, rather, stumbled across).

We have the device kicking into Developer Edition using the CID write, and a hardware modification, which we stumbled across (demo: here, credits to [MENTION=4999212]PaulPizz[/MENTION] for spending late nights testing the various things I would throw at him, and having the balls to do some dangerous stuff that I personally believed would permanently brick his device). This method is volatile, dangerous, and quite honestly, shouldn't work. When I am confidently able to prove how it works, I will release details on my blog: here. Until then (shouldn't be more than a month, but as always, this is a free time project, and could be put on hold for real life, as I am busy with Cyber Security competitions).

What will most likely be the course of action once I release:

- Change CID to a provided Developer Edition CID

- Use hardware mod to flash/boot the custom kernel I have build to enable module loading (or maybe I'll build the function into the kernel itself, haven't decided yet)

- Either load the module, or call the function (if the latter, I'll write a binary to do so)

- Revert the hardware mod

- Flash Developer Edition Aboot via ODIN

This should be bootloader version agnostic, but, as always, beware updates, and, I'd stay away from any incoming MM updates on all locked carrier variants if you want to retain the ability to use this. If Samsung can update the eMMC firmware using those vendor commands, they can sure as heck change them the same way. Then the ability to do this goes away entirely.

You may be asking, "Can I donate to progress?"

Well. Sort of. Beaups asked that all donations go to the Make a Wish Foundation, or [MENTION=766721]ryanbg[/MENTION] (as he is getting hitched :), may you forever 'make cooking' Ryan! Haha.).

If you'd like to donate to me, know that it is not for the CID write, but instead, the work and research put into getting this all worked out for this device. I will also be dividing any donations sent to me with my tester, as he has spent a fair bit of time on this, as have I.