yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 Android Development] yossijoe:
Wrong thread.
[Verizon Galaxy S 5 Android Development] yossijoe:
Now clean up now all the posts about this..
[Verizon Galaxy S 5 Android Development] GeTex:
Can we stop getting posts that have nothing to do with R&D

I'm working on changing the CID for Toshiba Chips but it seems I am stuck. The info I have is useless at the moment.
[Verizon Galaxy S 5 Android Development] monk3brain:
how can i help?

I have an Odroid development board and a Toshiba CID 11 EMMC module. I figured I could use this to hack on the Toshiba EMMC CID firmware without risk of damaging my phone. I have some firmware development experience, time to devote to this, and a desire to help unlock the bootloader on my CID 11 S5. Is there anything I can do to help? Thanks for all your efforts thus far.
[Verizon Galaxy S 5 Android Development] GeTex:
Dump the emmc controller firmware. I can't even do it with a riffbox
[Verizon Galaxy S 5 Android Development] monk3brain:
Can you provide the steps you took when you tried to dump the firmware?
[Verizon Galaxy S 5 Android Development] Hariiiii:
Perhaps the firmware is available somewhere through open source? Check out this old post in the eMMC brick bug thread:

http://xdaforums.com/showpost.php?p=38087513&postcount=77
[Verizon Galaxy S 5 Android Development] Coldblackice:
Dude, you are the hero Gotham deserves. Well done.
[Verizon Galaxy S 5 Android Development] Surge1223:
I've been trying to modify the sec_param.c driver to allow me to see what the hell gets written there, and it seems like they intentionally make it so that the driver doesn't allow opening the contents, seriously look it. It bothers me, because a lot in the bootloader suggests temp values are compared to in param for mmc functions/outputs
[Verizon Galaxy S 5 Android Development] GeTex:
Is there any way to intercept what's written live by direct I/O. Otherwise yeah I saw something about that.

Might be easier to do eMMC swaps tbh :P
[Verizon Galaxy S 5 Android Development] monk3brain:
Thanks for all the info above. FYI, this is the eMMC module I bought from ameridroid: (can't post links yet) "8gb-emmc-5-0-module-xu3-linux-blue-dot" . Odroid says they're still using toshiba for eMMCs for the 8 GB modules. I have the Odroid XU4, running Ubuntu off this eMMC. It shows the CID as 11010030303847453000195cd55433fd. I'll look into those links you shared.
[Verizon Galaxy S 5 Android Development] beaups:
Everything was pretty well explained (re: samsung) in the doc I wrote. If you haven't read it, its here: http://theroot.ninja/disclosures/SAMDUNK_1.0-03262016.pdf

Most of what [MENTION=4492965]AdmiralKirk[/MENTION] is accurate and well stated. Although any "direct-io" or pads, etc, are unlikely to help, unless Toshiba decided to expose something out-of-spec.

At a minimum, you need their vendor commands, then hope there's a method to dump firmware, then hope there's a backdoor to rewrite the CID.

It's quite a longshot IMO, you'd all probably have better luck trying to find aboot bugs.

--beaups
[Verizon Galaxy S 5 Android Development] Surge1223:
The s5 aboot was interesting, but unfortunately Samsung is now releasing emmc_appsboot.mbn in arm64 ELF format, and even though ida has an ELF Loader, I'm pretty sure you cant decompile using the ELF64 loader (until someone leaks a 64 bit ida hexrays decompiler)

I started adding code to load the ELF64 arm format in ida (while using the 32bit version) until I realized I just didn't care about Samsung phones anymore.

https://github.com/Surge1223/ida-mbn-sbl-loader/blob/master/ida-mbn-sbl-loader.py

So aboot bug hunting looks bleak for the next generation.

Ryan and I took one loon at the S7 aboot and collectively agreed, no more new aboot exploration. [emoji724]
[Verizon Galaxy S 5 Android Development] beaups:
IDA loads these ELFs just fine, sometimes you have to manually flip the T register or move a segment around, but otherwise it's fine.

I have the 64 bit decompiler, but I rarely use it, as I find it's easier to spot bugs in the disassembly.

--beaups
[Verizon Galaxy S 5 Android Development] Surge1223:
Hmm maybe it was the the s7e emmc_appsboot.mbn only then, I know it loads them but the offsets were very wrong for me.

I compiled an 8894 lk from source, making sure to keep symbols, and loaded it to compare to the the 8894 lk from the s7e, and the section headers were not as expected, I mean they won't be the same but should follow the general pattern. Seems like they relocate the sections differently based on whether it's sbl/mbn format header.

specifically the data and rodata segs are not resolved, very annoying. But it could be just Samsung for all I know. I use the loader to flip the T register when it finds arm instructions, it just sucks trying to create a pattern for the loader to search for.

Luckily, these are ways consistent and easy to find

So far I have code (.text.boot, .text) and data segs dynamically being found and loaded but doing the same for the other segments seems like a lot of work.

(sorry for derailing thread OP)
[Verizon Galaxy S 5 Android Development] Barabba11:
thanks guys, I feel you're close to the solution! Keep efforts, we're waiting you :)

Do you succeed dumping emmc?
[Verizon Galaxy S 5 Android Development] beaups:
Nobody is close to any solution. I don't think anyone with any skills is even working on it.
[Verizon Galaxy S 5 Android Development] GeTex:
I've been on and off looking at it with a few other users, but in all honesty, I don't even think it's worth doing anymore, the S5 is really getting old, and tbh, it's a headache. The work you and ryan and everyone else put it was intense and I don't have that kind of time with everything going down right now, i started and was moving but I think i'm done. Samsung is just killing all the fun, I'm going back to a different device line :'( sucks cuz i liked the Galaxys but i want more freedom
[Verizon Galaxy S 5 Android Development] ldeveraux:
Wow. Just wow.
[Verizon Galaxy S 5 Android Development] klabit87:
FYI.

Kexec is entirely possible if someone were to take time to work on it.
[Verizon Galaxy S 5 Android Development] oka1:
From the Moderator

People,

Please Post Respectfully or DO NOT POST.... easy really

Do no personalize or post pointedly toward others.

Samsung like many other makers are trying to get more revenue out of the phone ... Locking the phone allows them to data mine more as well as provides a secure platform to use pay systems (which require this)

The issue I see is that the kernel could be partitioned differently which would allow this while still allowing Rooting and Customization.

But, that would require effort on their part....... So, they take the easy path... and lock everything

As of Late, it appears that the only Samsung phone that has decent rooting has been the TMO/Sprint Note .... we will see if that continues

Remember, be kind and civil when posting

Thanks. ~~~ oka1
[Verizon Galaxy S 5 Android Development] Hariiiii:
Read this thread here:

http://xdaforums.com/showthread.php?t=1266827&nocache=1

Kexec requires a kernel that supports it. I have personally tested kexec and it is not implemented in any stock SGS5 kernel. Therefore, we have only one hurdle to cross to make kexec work: to be able to boot into safestrap with a modified stock kernel that supports kexec. Can it be done? As best I understand, we cannot modify any part of the kernel and still have it boot.

Calling on anyone in the community that knows how this works better than I do: is it possible to modify the kernel and still reach safestrap?

EDIT: Here is some info on patching kernels with Kexec support:

http://xdaforums.com/showthread.php?t=2104706
[Verizon Galaxy S 5 Android Development] klabit87:
I've already gotten the kexec hardboot patch implemented in my own kernel.

The issue I have right now is on hardboot it gets lost and hangs.

So i am ordering the right parts I need to build a uart cable so I can log what is happening as where it is getting stuck can't be logged.

But the real issue of course is getting kexec to work with a kernel that can't be modified.

You can use a similar method as the bypasslkm exploit which I have done in the VZW s4 for the lollipop firmwares.

I haven't looked in depth but Im sure it could be done on s5 as well.

Once the correct address has been found to redirect the address to a noop function you would be able to load unsigned kernel modules on the device.

From there you would need to build the kexec module and debug the soft boot.
[Verizon Galaxy S 5 Android Development] Hariiiii:
[MENTION=4939386]Surge1223[/MENTION] I know you're sick of samsung phones but do you think you could help with this? I don't have a copy of IDA. I see no reason why it shouldnt work. Getting the kernel patch and kexec together is probably 20 minutes of work. The only probable challenge is debugging the soft boot. But i think if you can get kexec working it might attract enough interest to the cause. Basically all that needs to be done is listed in the thread linked below. A stock SGS5 kernel needs to be decompiled, loaded into IDA, and then an address needs to be found. Then from the source code linked at the bottom of the post, about 5 lines of code needs to be changed to incorporate the new address. Then once the code is compiled, we just need to download the kexec kernel module and run it. Thanks.

Link:

http://xdaforums.com/showthread.php?t=2578566
[Verizon Galaxy S 5 Android Development] klabit87:
He is aware of the exploit.

But he does not own an s5.

Maybe somebody that actually owns an s5 should work on it instead of asking other people to do it for you?

I am close with the kexec hardboot.
[Verizon Galaxy S 5 Android Development] Surge1223:
I'll tell you what, if you send me the stock boot.img and I'll try to decompress it and find the address from my phone. If i find it, I can get you that far. And give advice on kexec. But I'm not going to download a 4gb factory tar for the s5 just to grab the boot.img
[Verizon Galaxy S 5 Android Development] Hariiiii:
Thank you! Here's a safestrap flashable zip of the PB1 kernel from jrkruse.

https://www.androidfilehost.com/?fid=24438995911970806
[Verizon Galaxy S 5 Android Development] daredevl99:
I bet if you asked [MENTION=5848265]npjohnson[/MENTION] he would love to help
[Verizon Galaxy S 5 Android Development] al50:
As GeTex and others have recenty posted, this is a R&D thread. Unless you have some info or something to offer for unlocking the Toshiba eMMC 11 please refrain from posting unrelated information.
[Verizon Galaxy S 5 Android Development] GeTex:
[MENTION=7017329]Hariiiii[/MENTION] keep me posted, seems you are figuring out kexec better than I was and have better equipment on hand

Where can I attach a UART? I have a full kit I use for working on control panels and other com devices

If surge give us that help, maybe we can pull this off? I have a GS5 11 to test on, so inform me if anything changes :)
[Verizon Galaxy S 5 Android Development] klabit87:
Lol wow.

I'm sorry but wow.

......... Did I just miss something??
[Verizon Galaxy S 5 Android Development] GeTex:
What are you going on about? If you arent contributing please stop posting here
[Verizon Galaxy S 5 Android Development] klabit87:
Am I contributing? Are you serious?

I just told you guys exactly what needs to be done

I'm pretty sure one could call that contributing.

After I do tell you guys what is needed, someone then asks a dev to do the work for them?

No mention of at least trying to do it yourselves.

You give the guy credit for "figuring it out".

What gets me is there are so many users here waiting for a handout.

But none that want to attempt to do any work.

I even tell you guys that I've gotten the kexec hardboot mostly done and still be has kexec figured out?

That is my confusion. That is what I'm going on about.

I'm pretty sure that is contributing.

If not then maybe I misunderstand the definition.
[Verizon Galaxy S 5 Android Development] Hariiiii:
I think Getex accidentally took you for someone else. A lot of people post random junk in this thread so I think it's become a bit of a reflex. You are absolutely right that I deserve no credit for this. The credit for what we have so far goes to you and Surge. I felt bad to bother him with this but I really don't have a copy of IDA and he was literally the first person I could think of who did. I am more than happy to do whatever it takes to contribute to this, but there are some things that I can't do with what I have. Frankly all I need is the address and the rest I think I can put together myself. We'll see if he had any luck. Let's make this clear right now though: this was your idea and your project. Any and all credit goes to your work in figuring this out and debugging it. I'm just another guy who is trying to help.
[Verizon Galaxy S 5 Android Development] klabit87:
Thanks. I apologize for the rant.

Those same random junk posts you speak of have frustrated me.

I am excited to see where this will lead and I sincerely appreciate your interest.

I started decompressing the zimage last night to load into ida.

The last one I did had grip compression. The s5 has lzo compression so working on that.

I have done everything properly but it still doesn't want to decompress.

But I have everything ready all we need is the address as I have a script from the previous work thanks to surge for getting me started on it and I have a kernel module that I compiled last night we can test.

I have done all of this before on the s4 so not gonna be too terribly bad.

The hard part as I said will be debugging the kexec softboot.

Also for the uart setup I don't know if you have it or not but I will share a link that has helped me when I get home this evening.

I just need to sit down and actually order the parts.

I've been working on kexec hardboot so I could port multirom which I've gotten everything ready for.

I've compiled the multirom recovery and multirom binary so we can get the startup to show trampoline on bootup.

I know kexec hardboot doesn't do locked bl users any good but it's a step in the right direction for kexec as a whole.

I've read plenty and implemented a good portion of kexec and am willing to help with whatever I can
[Verizon Galaxy S 5 Android Development] Hariiiii:
I have decompressed the NK2 kernel and attached it to this post. I think ultimately we will need to keep the NK2 kernel on the device to reach safestrap and then flash a zip to boot from there. Let me know if I decompressed it properly. As best I can tell it worked fine. In case you haven't gotten to this yet, this might also be helpful for you [MENTION=4939386]Surge1223[/MENTION]

The kernel contained two magic headers for some reason. That may have been the problem you ran into. The second one was the correct one.
[Verizon Galaxy S 5 Android Development] klabit87:
Thanks. I wasn't thinking and was working on the pb1 kernel.

But I will load it up and dig through.

Surge is faster than me but I still like to do it myself so I can learn it.

Been working on it in my spare time which isn't much. Lol
[Verizon Galaxy S 5 Android Development] GeTex:
[MENTION=4168602]klabit87[/MENTION] sorry, confused your post with a junk post. To many new faces to remember who is who. So I'm reading posts now. I don't have much to contribute till I have my life in order, my apologies. What I do remember is I couldn't get Kexec to work as it would get killed with the old kernel. I don't even recall if I got it to load correctly. But what you are doing seems interesting. I'm gonna try and follow
[Verizon Galaxy S 5 Android Development] klabit87:
[MENTION=7017329]Hariiiii[/MENTION], did you mean that is the NI2 instead of NK2? or is it the NK2? just want to double check.

I made the NI2 flasher assuming that was the last kk rom version way back when.

If so then I will need to put in for a request for the NK2 kernel source.

Just need to figure up a kernel that we are going to use and stick with.

Thanks.

Thank you.

I am curious, what were you using to test kexec? Just running the binary compiled against the klte tree?
[Verizon Galaxy S 5 Android Development] GeTex:
>.> Maybe... Actually PsychoAngel was compiling it for me(i think she doesn't have an xda account anymore or never did) But I also was getting lost with it. I need to do more reading but I can't without internet
[Verizon Galaxy S 5 Android Development] Hariiiii:
Yeah it's NK2. I can easily decompress NI2 tomorrow though if that's preferable. I think it's easy enough to just flash NK2 with FlashFire though...
[Verizon Galaxy S 5 Android Development] klabit87:
No that's ok. I just wanted to make sure i was on the same page.

I have already requested kernel source for nk2 so shouldnt take too long to get that.

I just need to take the time to dig for the address. Only done it twice before.
[Verizon Galaxy S 5 Android Development] Rakuu:
Sorry if this post is out of place, but would kexec be a possibility for att S5s? I'd gladly lead a thread in our section if its possible.
[Verizon Galaxy S 5 Android Development] klabit87:
I don't see why it wouldn't be.

Just have to use the same method.

I'm not saying any of it is easy by any means, I just believe it's very possible.
[Verizon Galaxy S 5 Android Development] Rakuu:
Awesome! When I get time I'll look a little more in to it and start a thread, thanks.
[Verizon Galaxy S 5 Android Development] Hariiiii:
I was tempted and so I dug around in the kernel with a free version of IDA. It doesn't technically allow disassembling ARM instructions so I just loaded it as x86. I poked around in the disassembled code just before the "<4>[ 2003.012237] TIMA: lkmauth--verification succeeded." string where the BNE instruction was found in the thread linked below. I found a JZ instruction there which is the x86 equivalent of BNE....so...I might have found the address. Or maybe it doesn't work that way. I have no idea what I'm doing. Take a peek at this address if you have a moment:

0x00DA13E3

Here's the thread link:

http://xdaforums.com/showthread.php?t=2578566
[Verizon Galaxy S 5 Android Development] klabit87:
I have found the address but I will look at that one as well just to be sure that I didn't overlook something.

But I have hit a snag.

We do not have access to the physical memory.

In the past I've been able to use /dev/mem to overwrite the proper memory address but none of the s5 kernels have the mem device available in the stock kernels.

So need to find a way to read and write to physical memory.

I am investigating that right now in my evenings.
[Verizon Galaxy S 5 Android Development] AdmiralKirk:
Perhaps using the Futex vulnerability would be of use? I'm shooting in the dark here because I'm not 100% certain yet what exactly it is your trying to accomplish. But I know the Futex Vulnerability used by TowelRoot allowed writing to Kernel Memory to a limited extent. And I know their is a signed kernel for the S5 that is vulnerable to this issue. Again, sorry if this is not useful. If it is, the following links may be useful in making use of it: http://blog.nativeflow.com/escalating-futex http://blog.nativeflow.com/pwning-the-kernel-root
[Verizon Galaxy S 5 Android Development] Rakuu:
Would such an exploit not only be applicable to KitKat though?
[Verizon Galaxy S 5 Android Development] AdmiralKirk:
I suppose that would depend on weather a kitkat kernels kexec could boot a lolipops kernel.
[Verizon Galaxy S 5 Android Development] klabit87:
Just looked at that address and it appears that will not work being that IDA didnt disassemble it properly.

This is what i see at that address.

ROM:00DA13E0 LDR R4, [R6,#4]
ROM:00DA13E2 MOVS R5, #0x20 ; ' '
ROM:00DA13E4 MOVS R0, #0x64 ; 'd'
ROM:00DA13E6 LDR R5, [R4,#0x44]
ROM:00DA13E8 LDR R5, [R4,#0x54]
ROM:00DA13EA LDR R5, [R4,#0x64]

That has been brought to my attention and I just barely started looking at it last night.

Thanks for the extra input.

From my understanding, all kitkat kernels are vulnerable.

I am also looking at the possibility at using an eng kernel.

It is not definite that we can use it, just more likely. If anybody knows where to find them FOR FREE I would greatly appreciate it.

I have found 3 different versions all of which are pricey for what they are. And are honestly not worth it to me.
[Verizon Galaxy S 5 Android Development] GeTex:
I remember something stupid in the newer kernels that if you try and write to kernel memory space while its running, for whatever reason, something causes the phone to shutdown(with animations and everything), this behavior doesn't exist within KitKat kernels. So I find it intriguing. I fear the vulernability will have that issue, also the bootloader for lollipop will not allow users to flash a system(qfuse) but allows flashing kernel, concerned we may have an issue with that as well... Or I'm reading this all wrong

This is brutal. I'll need to do more research once I have internet which may not be for months now. >.>
[Verizon Galaxy S 5 Android Development] klabit87:
Of course the s4 lollipop kernels are different from the s5 but in s4 I was able to do all of this on lollipop kernels that I am attempting on the s5.

The only reason it would cause a reboot (kernel panic) would be if you overwrite the wrong addresses.

Also I am on pb1 unlocked bootloader and have flashed a kitkat rom and kernel using a twrp based recovery that I have been testing something else with which booted and is running fine.

I also know a user that is on pb1 locked bootloader that was able to do the same by flashing with flashfire.

So. You can flash a kitkat rom and kernel and also have it boot and run.

How were you writing to kernel memory? That would be extremely useful right now.
[Verizon Galaxy S 5 Android Development] AdmiralKirk:
The Futex vulnerability should allow you to write to any kernel address, actually any address at all once fully implemented. I believe the site I linked to even had good example code to get you to the point of writing to any address (by modifying the protected address limit of the currently executing thread). I imagine the process would be something like, boot on a kitkat kernel, exploit Futex, load kexec module, boot lollipop/marshmellow kernel then appropriate rom. Only down side I could see is that the boot sequence would be somewhat long and complicated with a lot of chances for something to go wrong. I wish I knew more about Linux kernel development so I could help, unfortunately I am primarily a windows coder (its what they pay me for, not my personal preference). I do know C pretty well though, so if anyone needs a rubber duck, let me know :P
[Verizon Galaxy S 5 Android Development] Hariiiii:
I found a post on stackoverflow which appears to answer a couple of questions: first, he appears to be using a pointer to write to memory (he says he uses this method as a replacement for the /dev/mem method since it was removed). Here is the code:

unsigned char *my_ptr;

my_ptr = (unsigned char *)phys_to_virt((unsigned long)0x001C1D50);

my_ptr[0] = 0;

Second, there is a lot of information in the answer section about what needs to be done to map the physical address to a virtual address (and how kernel panic occurs), which will be a necessary step. Here is the thread:

http://stackoverflow.com/questions/...l-module-causes-kernel-oops-in-android-kernel
[Verizon Galaxy S 5 Android Development] klabit87:
That would be useful if we could load a module in the first place.

He compiled a kernel module and loaded it to modify the memory.

We need to modify the memory to load a module.

Since [MENTION=5414005]GeTex[/MENTION] has already done it I would like to know how she did it.

If it was done on a stock kernel then that's what we need to do.

Futex is still viable but I have never dealt with it so I will need to do a lot of research with it.

I hope to eventually get it.