yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 Android Development] GeoHogan:
Alright will get in touch with my contacts, will get back to you guys asap.
[Verizon Galaxy S 5 Android Development] GeTex:
Hi

I'll provide the emmc shortly inside the Toshiba S5's

Also I'll strip Angels code down later and see if I understand her work. The address I was trying to write is somewhere in my old project. I hadn't tried it recently, I was trying it back in 5.0, before we even had root so it's been like almost a year since i played with it. Others figured out a better root method and i ditched the project. My biggest issue is that I cannot recall how we were writing, but I think our biggest issue was we attempted to write to protected memeory spaces that 5.0 introduced that 4.4 did not have, but then again, I have no idea how it works because I rarely deal with this. not to say I'm clueless but My only working computer right now is an Old Thinkpad T42 and I only have cellular for internet... I'm very limited and can only help so much!!! I apologize big time. Also in between jobs, so alot of my time is spent trying to make money and get a job because rent.

On a side note, some clown messaged me "claiming" he has cracked the signing key for signing the odin files so if that is really the case, I'll try and sign a odin file and flash it to my galaxy S5. I am 100% sure it's an attention seaker but I'll find out.

I believe the Toshiba S5 Emmc is a THGBMBG7D2KBAIL

I cannot confirm but I thought that was the chip.
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
pdf at bottom of post

this is a Toshiba official release that discusses among other things how to put in a emmc chip in a device and how emmc chips work

this discusses the toshiba emmc chip that comes installed in some of the s5 verizon phones

http://www.toshiba.com/taec/adinfo/technologymoves/pdfs/2013/eMMC 5 FINAL 10-30-13.pdf

Key Specifications

Product NameTHGBMBG7D2KBAIL

Interface JEDEC e-MMC V5.0 standard

HS-MMC interface

Capacity 16GB

Power Supply

Voltage

2.7～3.6V (Memory core)

1.7V～1.95V / 2.7V～3.6V (Interface)

Bus Width x1 / x4 / x8

read speed 50MB per sec.

Sequential/HS400 Mode)

write speed

(Sequential/HS400 Mode)

270MB per sec.

(

Temperature

Range

-25degrees to +85degees Celsius
[Verizon Galaxy S 5 Android Development] al50:
That link is blank, as well as the file when downloaded
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
That's weird on my PC I just went to that link try on a computer

---------- Post added at 10:09 PM ---------- Previous post was at 10:04 PM ----------

i just put the pdf up as an attachment on the post so look there
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
PLEASE READ ME this is the kind of stuff in this PDF look below

jedec 5.0 standard it looks like a lot of info about emmc chips

this is the industry standard at the time of the toshiba emmc chip being produced so this is probably exactly how it is inside your phone

i think for the right person it might be the motherload

this is a zipped pdf if it doesn't open or something i can email it to you

Boot Partition Write Protection

In order to allow the host to protect the boot area against erase or write, the e•MMC shall support two

levels of write protection for each of the boot areas: Permanent write protection or power-on write

protection. This protection can be applied to each boot area individually or to both regions at the same

time using the BOOT_WP register (EXT_CSD[173]).

The host must be aware of the following when writing the BOOT_WP register:

 All the bits BOOT_WP register, except the two R/W bits B_PERM_WP_DIS (bit 4) and

B_PERM_WP_EN (bit 2), shall only be written once per power cycle. The protection mode

intended for both boot areas will be set with a single write.

 Two bits in the register are type R/W, B_PERM_WP_DIS (bit 4) and B_PERM_WP_EN (bit 2)

the first write to the boot register will permanently set these bits. The flow chart in Figure 24

should be followed for the first write to register BOOT_WP to properly set these bits.

 If the B_PERM_WP_EN bit is set for only one boot partition, the host should ensure that

B_SEC_WP_SEL (bit 7) and B_PERM_WR_SEC_SEL (bit 3) are set correctly to avoid

accidently permanently protecting the other boot Area.

The host has the ability to disable both permanent and power on write protection in the boot area by

setting B_PERM_WP_DIS (EXT_CSD[173] bit 4) and B_PWR_WP_DIS (EXT_CSD[173] bit 6). If

boot area protection is not required it is recommended that these bits be set in order to ensure that the boot

area is not protected unintentionally or maliciously

page 33 of pdf

copyright notice

State Technology Association 2013

3103 North 10th Street

Suite 240 South

Arlington, VA 22201-2107

This document may be downloaded free of charge; however JEDEC retains the

copyright on this material. By downloading this file the individual agrees not to

charge for or resell the resulting material.
[Verizon Galaxy S 5 Android Development] GeoHogan:
Got ino touch with my Samsung contact and he was able to link me to the Samsung developer team, the only way they can do it is if I ship the phone into them, I'm curious if since I'm on the 11emmc chip if they'll still be able to do it and if they do if it'll help us when I get it back going to drop it off at ups probably tomorrow. This wildfire up in the High Desert is killer so I don't know when it'll get there.
[Verizon Galaxy S 5 Android Development] Hariiiii:
If they unlock your bootloader it will do us no good at all. They will simply write a bootloader with your CID included and sign in with their key. The bootloader on your device will only work on your device. What is needed is either a bootloader that doesn't check the CID, a signing key for the bootloader, or the vendor commands for the toshiba emmc.
[Verizon Galaxy S 5 Android Development] GeoHogan:
Got it, so that doesn't do us any good, any other way I can commubicate with them and ask them for a proper unlock for the phone?
[Verizon Galaxy S 5 Android Development] doubleaykay:
Ask them if there is any way to write to the eMMC firmware and change the CID. Mainly, we need to know the vendor commands for Toshiba eMMCs used in Samsung's phones, so those are also a good thing to ask for. If you aren't already too far in, you could even say it's for a personal project or something...
[Verizon Galaxy S 5 Android Development] klabit87:
As it has already been mentioned, we do need a bootloader that does not check cid. We need a bootloader that allows for custom recoveries and kernels.

If you can pull this off that would be awesome! I would honestly be shocked though, I just dont foresee them allowing this to happen.

Vendor commands would also be very useful so that we can have a way to write a new cid.

I know this has already been stated. Just further supporting. :) :good:
[Verizon Galaxy S 5 Android Development] AdmiralKirk:
I wouldn't get your hopes up to be honest. If anyone at Sammy released a bootloader without kernel signature checking that could be uploaded to any S5 they would be fired. If someone at Sammy released the private signing key for the bootloaders they would literally be murdered on the spot. A bootloader that doesn't bother with kernel signature checking that is locked to a specific phones cid is much more likely but also not of any use to us. But hey, if you found someone at Sammy who's feeling suicidal more power to you :P Even a data sheet on the unpublished vendor commands for the Toshiba eMMC would be cool, although its only 50/50 weather that would actually be of any use.
[Verizon Galaxy S 5 Android Development] GeTex:
I had no luck getting Toshiba to release the full vendor CMD's, they gave me a few But left alot out(including how the CID is written, even the first time) nor any technical document on how it's done. Sounds silly but It may be faster for everyone to mail me their 11's and I'll just start swapping the eMMC's using my now repaired BGA rework station. I have a supplier with the Samsung eMMC's and a riffbox around here somewhere... I don't see why i couldn't :P
[Verizon Galaxy S 5 Android Development] Barabba11:
in my opinion those infos are really precious, if used properly they can allow write inside emmc into protected area, then it's needed to create a software which can force flash am unlocked bootloader inside.
[Verizon Galaxy S 5 Android Development] GeTex:
You don't understand at all whats going on do you?

We have been able to force flash any bootloaders for a while now. Nothing stops us from doing that, a simple rooted device with a DD command will flash it anyday.
[Verizon Galaxy S 5 Android Development] brd912:
Fingers crossed I don't get flamed for posting something with little knowledge but has anyone here heard of the app sunshine for Motorola and htc devices? I know they're totally different devices but some of the devices it can unlock pretty easily have been a pain and literally impossible to unlock before..I'm just wondering if any process they use could be of help here.
[Verizon Galaxy S 5 Android Development] al50:
Saving you from hopefully getting "flamed"...yes i have heard about sunshine and it's capability and i believe the top Dev's have as well. Especially, if i'm not mistaken, Beaups(the MAN who actually brought us the SamDunk by the discovery of the backdoor leading to the bootloader unlock) and JCase were involved with Sunshine. So i believe it would have been brought to light by them and/or by now....also, to save flame to you by others. Getex and others involved with this have repeatability asked that unless you have something concrete to help with or bring to the "plate", to please refrain from posting anything not useful....no pun intended and not directed towards you....

To the OP and DEV's, my apologies for being OT:o
[Verizon Galaxy S 5 Android Development] GeTex:
well you saved him the flames!
[Verizon Galaxy S 5 Android Development] GeoHogan:
I have a spare water damaged s5 I can send, working on getting more s5s tomorrow. I work at a Verizon retail store so I have customers bringing them in all the time. I think Ivery only ever had one bring in one with a 15emmc?
[Verizon Galaxy S 5 Android Development] GeTex:
I can possibly use that, depends on what needs to done to it. I have boards that are supposed to go to [MENTION=5209970]al50[/MENTION] (I never heard back :( )
[Verizon Galaxy S 5 Android Development] GeoHogan:
Message me where to send it and I'll send it Monday
[Verizon Galaxy S 5 Android Development] blair.sadewitz:
I have a water-damaged S5 as well. I think it works, just no screen. If it helps development, tell me where tos end it.
[Verizon Galaxy S 5 Android Development] klabit87:
This task has proven to be much more time consuming than I initially expected. Admittedly, I opened my mouth before digging drop enough.

I apologize for that.

I still believe it is possible for unsigned kernel modules to be able to load. Including a kexec kernel module that is crafted properly.

I just don't have enough time to dedicate to it at this moment.

I started multirom a while back and have not been able to finish it either.

I want to finish that first then I will come back to this.

So I am sorry if I have dampered anybody hope with this post.

But as I said I fully believe it is still possible.
[Verizon Galaxy S 5 Android Development] GeTex:
I just don't have the resources to continue, I am building another S5 so if it works, I'll start testing anything we can come up with. But with all my laptops kicking the bucket, and lacking internet, I'm not sure how much more I can do. Moneys bad. [MENTION=4168602]klabit87[/MENTION] I think it may be possible as well. Let me know if theres anything I can do to help with my limited resources
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
I don't know if this will help but cyanide for android mm aosp rom has an is engineer build I went to adb while on cyanide and put in the command adb diisable-verity but it said something about it already was and that I was using an engineer build just in case this is helpful

---------- Post added at 10:43 AM ---------- Previous post was at 09:58 AM ----------

This may be useless to you I'm sorry if it is just sharing my latest work that may or may not be of use shoot me me down if I'm not helping

With flashing the system boot and recovery and cache of another s5 model for lollipop firmware on s5 Verizon I have successfully booted t-mobile dob1 partial firmware and g900f boi3 partial firmware on g900v it is safe to do using flash fire on rooted s5 verizon with a locked bootloader

what is stopping a kernel exploit to disable dm verity for instance

Flashing boot causes a soft brick but led light comes on on g900f firmware if you do a cache and data wipe in recovery if my memory serves me correctly so a ok3 root style exploit is a slim chance

(This means phone is connected to computer by USB

right or wrong?)

upon restart other three partitions don't affect boot but recovery is no longer available to you if you flash recovery

This has an interesting feature when the device is in setup wizard the phone seems to think it is a new device this is not the oem first boot but the second user configuration boot I think correct me if I'm wrong it says add/sign up for Samsung account In setup wizard not normal Samsung setup wizard login screen on s5 Verizon but a different one

locked bootloader staus doesn't change after using flashfire to flash partitions

But the system still thinks you are on official Android it says official in download mode under system and under current binary

According to jrkruses how to flash mm tw custom Roms on locked bootloader s5 Verizon thread you can use safestrap to flash zip files on a locked bootloader just saying such as adding Hotspot support and removing Knox

maybe only system mods though hmm maybe kernel mods can be flashed on a locked bootloader probably not but the boot partition is not a protected partition according to flashfire so possibly

What are your thoughts??

Am I batsh*t crazy or am I onto something
[Verizon Galaxy S 5 Android Development] klabit87:
You are all over the place with your post.

Not entirely sure if I understand what you're trying to accomplish.

But as far as the eng kernel it will absolutely have to be an official samsung kernel.

Anybody can build an eng rom cm/aosp based. But we need official samsung since locked bl users can't flash custom kernels

There are some of there but it's almost I crapshoot. I honestly can't say it will work or not for certain. That is why I say they are pricey for what they are.

I have the link somewhere.

Dm-verity only applies to the mm kernel. That is not an issue in the lp kernel.

If you can find an official eng Odin package that would be extremely appreciative.

As I said, I haven't found any that are free.

I can get you the firmware version info to help look for it.

Let me know. Thanks.

EDIT: this is the firmware version that might be the most promising. It's closest to pb1 I believe.

COMBINATION_VZW_FA44_G900VVRU2APA1_VZW2APA1_2572656_REV00_user_mid_noship_MULTI_CERT.tar.md5
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
What I was trying to say is

Is it possible to flash modification zips with flashfire to alter the system boot you know etc to make it have already known security vulnerabilities or modify it in a way that will help us on official rooted lollipop firmware with locked bootloader for g900v
[Verizon Galaxy S 5 Android Development] klabit87:
ah there is no way to modify the boot.img without causing the bootloader to pitch a fit.

I have looked at all of the kernels for any possible solutions to access the raw memory. And none were good candidates.

Although i only looked at vzw kernels. not sure how well non-vzw kernels will work for what we need.
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
here is something [ROM] Sprint Marshmallow N920PSPT2BPA2 Engineering Build

http://xdaforums.com/sprint-galaxy-note5/development/rom-sprint-marshmallow-n920pspt2bpa2-t3328880

it is possible to flash n920 rom port for g900v

http://xdaforums.com/verizon-galaxy-s5/development/note-5-port-norma-v3-2-final-fast-t3369813

im reflashing official pb1 firmware then i will root and attempt to flash first link to my device it can boot on the s5 look at second link

this one allows flashing this rom with a locked bootloader also http://xdaforums.com/verizon-galaxy-s5/development/rom-mm-note5-port-rom-t3395218 so i will see if i can flash first link with safestrap on pb1 root bl locked will see what happens

ps it seems that as long as the 4 unprotected partition system,boot,cache,recovery are official it doesn't matter what s5 model version it comes from it flash and it will boot properly when flashed in flashfire as long as it is the same os lolipop to lolipop on your phone and the firmware files you are flashing

found this ive never heard of an engineering bootloader interresting

"This is not a Sprint Note 4 Marshmallow firmware, but it’s pretty close as far as Marshmallow update goes for the device. The ROM provided below is based on Samsung’s own Android 6.0 code, and thus comes with TouchWiz, as against the AOSP Note 4 ROMs we call unofficial Marshmallow updates. This requires installation of engineering bootloader and PB5 firmware’s baseband to work properly."

http://www.theandroidsoul.com/sprint-galaxy-note-4-gets-marshmallow-leak-in-twrp-flashable-rom/

found an s6 lolipop engineering bootloader http://xdaforums.com/galaxy-s6/general/s6-g920f-5-0-2-engineering-bootloader-t3209916

---------- Post added at 08:38 PM ---------- Previous post was at 07:53 PM ----------

Downloads

there is special odin version for engineering bootloader

AT&T Galaxy S7 G930 Engineering Bootloader: Download link

AT&T Galaxy S7 EDGE G935 Engineering Bootloader: Download link

Special Odin version for engineering bootloader: Download link

http://androiding.how/root-att-s7-s7-edge-engineering-bootloader/

is it safe to flash s6 lollipop engineering bootloader on rooted g900v bootloader unlocked on pb1 lolipop
[Verizon Galaxy S 5 Android Development] klabit87:
I'm only going to warn you against it. ANY bootloader that was not specifically built for said device WILL NOT work.

S6 bootloader on s5? No

S7/s7e eng kernel on s5? No.

Rom ports use a stock VZW S5 kernel.

So no gain the either.

The fact that you have never heard of an engineering bootloader should indicate the need for you to research more before flashing anything.

Not trying to be rude or mean.

Just trying to keep anybody from having a paperweight.

Also. The s5 can be bricked. Just not easy.

I have seen it happen on the s4 with a version that still supported the sd card debrick img.

I believe it is time for me to start looking at other devices though. So may be ready to get rid of my unlocked bl s5.

If anybody is interested let me know.
[Verizon Galaxy S 5 Android Development] GeTex:
I'm intrested in your S5(My friend would be the buyer), otherwise, if I cannot afford it, [MENTION=5209970]al50[/MENTION] has been dying to get one, he's the guy who donated one to me :)
[Verizon Galaxy S 5 Android Development] Hariiiii:
If you plug that filename directly in to google, the first result has it for free. I downloaded and extracted it and it looks legit. I flashed just the kernel alone on to my device and got a 'secure check fail: kernel is not SELinux Enforcing'. Remind me what exactly is the virtue of this firmware?
[Verizon Galaxy S 5 Android Development] klabit87:
Could you link me where you got it?

It is an official eng firmware.

I am interested in the bootloader.

The bootloader included may not check for enforcing.

The kernel alone may have some useful properties also but you tested what I would have also.

Usually the official eng firmware is much more lenient as far as security aspects are concerned.

Thanks.
[Verizon Galaxy S 5 Android Development] GeTex:
The question will be, can we load the bootloader? Or even find offsets to change ours?

Here's the link

http://firmware.gem-flash.com/index.php?a=browse&b=category
[Verizon Galaxy S 5 Android Development] klabit87:
I have no idea how i missed that. I have looked off and on for the past month.

Thanks. I am not sure if the bootloader can be loaded or not but I will have a look.

If it can be loaded it might be of great help im sure
[Verizon Galaxy S 5 Android Development] Hariiiii:
Heres the link:

http://firmware.gem-flash.com/index.php?a=browse&b=file-info&id=5323

I know it looks sketchy but theres nothing nasty in there to my knowledge. I opened the files on linux. You need to unrar it first to get the tar. I hope that this comes to something!
[Verizon Galaxy S 5 Android Development] klabit87:
I am breaking it apart also. Hopefully it may be useful.

---------- Post added at 05:33 PM ---------- Previous post was at 05:05 PM ----------

I have a tester. We are investigating it right now and he will be here to post soon.
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
i downloaded it and am trying to extract the rar file but it is asking for a password and default password doesnt work the websites address so what is the password?
[Verizon Galaxy S 5 Android Development] klabit87:
that is what worked for me

www.gem-flash.com
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
deleted
[Verizon Galaxy S 5 Android Development] klabit87:
yeah nothing useful there. I have already looked where I need to. do you know what you need to look for?

In order for any relevant info to be used it is best to do all testing with a toshiba emmc device.

doesn't do much good using it on an unlocked bl device honestly.

to be consistent it would be recommended to do everything on a toshiba.

which my tester has.
[Verizon Galaxy S 5 Android Development] Bren123:
Me and [MENTION=4168602]klabit87[/MENTION] have determined that it useless for us as of now I flashed it on my toshiba s5
[Verizon Galaxy S 5 Android Development] GeTex:
Looks like you all did what I just did, Nothing useful I found either. I do have a eMMC 11 device and another 11 Test device, Klabit, if you need me to test anything else, I can do so. I'm working on a possible solution but it may not help us since I have alot of testing to do. It honestly would be faster to build a cluster to crack the signature lol
[Verizon Galaxy S 5 Android Development] Bren123:
My dd is A Verizon Note 4 so I can use my 11 S5 as a test device if needed.
[Verizon Galaxy S 5 Android Development] klabit87:
That's not exactly what this thread is for. I believe you have, what 6, about that?

I see at least another 3 coming soon

---------- Post added at 07:02 PM ---------- Previous post was at 06:58 PM ----------

Thanks [MENTION=5414005]GeTex[/MENTION] I am looking at one other thing and I will need to start decompressing some stuff to look at in IDA.

I will let you know if I find anything useful

Thanks
[Verizon Galaxy S 5 Android Development] GeTex:
Thanks! If i can use this engineering kernel and bootloader to bypass reactivation lock

[MENTION=5209970]al50[/MENTION] a solution for that locked eMMC15 board right here for you
[Verizon Galaxy S 5 Android Development] Bren123:
Dude this is R&D for unlocking the Toshiba chip we already concluded that it is no use for unlocking the Toshiba chip and that its worthless there are other ways to bypass FRP than this this is probably the worst way so please stop cluttering up the thread about something we already said was useless.
[Verizon Galaxy S 5 Android Development] GeTex:
He was responding to me about using it to bypass reactivation locks
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
i have deleted my irrelevent posts
[Verizon Galaxy S 5 Android Development] Bren123:
Wasnt being mean just tired of people posting irrelevant stuff In this thread.

---------- Post added at 04:07 AM ---------- Previous post was at 04:04 AM ----------

OK that's cool. But isn't there better ways to bypass FRP than that buggy thing.

---------- Post added at 04:10 AM ---------- Previous post was at 04:07 AM ----------

Wasn't necessary. But ok.