yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 Android Development] GeTex:
Is there better ways? if so Guide me and [MENTION=5209970]al50[/MENTION] in a PM, cause I can't get a clear answer
[Verizon Galaxy S 5 Android Development] klabit87:
It appears that the version of firmware I was interested in was not in fact engineering firmware.

It was prerelease firmware and is not going to be helpful to us that I can see at this time.

Doesn't mean that it was time wasted though, it is another official firmware that can be flashed on locked and unlocked bl.

We were able to flash it via odin on a locked bl device with PB1 bootloader.
[Verizon Galaxy S 5 Android Development] GeTex:
I doubt it but is there any chance that we can modify the engineering bootloader similar to the way we modify the eMMC 15 bootloader to enable the developer flag without needing to have a CID tied to it via aboot? I'm getting lost in the process, but I think nothing will help us, the GS5 11 may be a lost cause at this part of it's life cycle
[Verizon Galaxy S 5 Android Development] klabit87:
I do not believe so. currently for the 15 we flash a samsung official bootloader for developer editions that matches the cid that we write to the emmc via the exploit.

as it stands now there of course still is no way to write the cid on toshiba.

and there is no way to modify the bootloader without breaking the samsung signature.

I am still searching for a true eng firmware. I have been told that most of those are unlocked.
[Verizon Galaxy S 5 Android Development] Bren123:
I actually talk to [MENTION=5209970]al50[/MENTION] I know him personally we have already discussed this subject he knows how to do it

Here

http://xdaforums.com/verizon-galaxy-s5/general/guide-verizon-s5-bootloader-unlock-100-t3446139

https://www.youtube.com/watch?v=DJ8_qbj1DPQ

The guide and the video explain 2 different ways. If you need more ways let me know.
[Verizon Galaxy S 5 Android Development] al50:
That’s correct. I've posted about the methods done and shown by RootJunky and posted links in the thread about unlocking the activation lock(FRP). He has 3 videos showing you step by step on how to achieve unlocking the activation lock..

I know it's been mentioned, so can we now get back OT....:o
[Verizon Galaxy S 5 Android Development] GeTex:
My Bad i was never told that you figured it out ever since i sent you an eMMC 15 board with the lock. I hope it is fun. Join me in Beeko's AICP V11 thread :)
[Verizon Galaxy S 5 Android Development] Hariiiii:
It might be worth checking in to the possibility of modifying the bootloader. It seems like the bootloader isn't checked like the others (no qfuse problem) before loading it.

EDIT #2: Nevermind...
[Verizon Galaxy S 5 Android Development] GeTex:
Lol, yeah no, it checks the integrity of the bootloader, anything else modded is a not sign of life condition

---------- Post added at 02:02 PM ---------- Previous post was at 02:01 PM ----------

This may be incredibly stupid, but I have a stupid idea, is there any Samsung eMMCs in micro SD cards vulnerable to this attack we used? If so, is it possible to load a full system to the microsd eMMC and change its CID the same way? I'm just thinking out loud now! I imagine the R/W performance would be awful
[Verizon Galaxy S 5 Android Development] Hariiiii:
If we can raise 32 dollars we can try the G900VVRU2AOI3 firmware here:

http://www.samsung-eng.net/index.php?dir=/Samsung_KNOX_Product_SW/G_Series/G900V

I know that it's older than the firmware we just tried, but I'm not sure if we are likely to have much or any more luck with it. Thats the oldest 'eng' firmware that I have found.
[Verizon Galaxy S 5 Android Development] Bren123:
Yeah me and [MENTION=4168602]klabit87[/MENTION] have seen that site I have heard it's legit but they do charge.
[Verizon Galaxy S 5 Android Development] klabit87:
My only issue with it is, it's not a sure thing.

It could be something or it could be nothing.

Don't really want people to put up any money with it not being a sure thing. But it is there decision for sure
[Verizon Galaxy S 5 Android Development] GeTex:
Heres the deal, if you really believe it will "help" I'll buy it in a few weeks, Just need to take care of rent which im almost a full month behind on

Keyword "believe"
[Verizon Galaxy S 5 Android Development] klabit87:
I don't think that is necessary.

There is a slim chance that it MIGHT be useful.

Definitely not worth going until debt over.
[Verizon Galaxy S 5 Android Development] GeTex:
Was hoping it'd help :(

Ugh, this is looking worse and worse everytime. Damn verizon
[Verizon Galaxy S 5 Android Development] klabit87:
yeah. the more info/firmwares we can get the better.

I just don't want somebody to waste the money on it and then not be helpful at all.

Thanks for the offer though. :)
[Verizon Galaxy S 5 Android Development] Bren123:
I may be able to buy it in 2-3 weeks if needed. But I don't see how that's the only website with those firmwares.
[Verizon Galaxy S 5 Android Development] Hariiiii:
It is definitely unlikely to be of any help. There's a slim chance we might learn something useful and an even slimmer chance it could really help us. Definitely the only kind of person who should consider this is one who really doesn't care about the money. I don't want anyone to make sacrifices for nothing here.
[Verizon Galaxy S 5 Android Development] jBarnett12116:
Hey all,

Long, long, long time lurker on XDA and finally have something worth posting. I managed to find the engineering firmware everyone was wanting and trying to pay for. The file is COMBINATION_VZW_FA44_G900VVRU2APA1_VZW2APA1_2572656_REV00_user_mid_noship_MULTI_CERT.tar.md5 so not the exact one everyone was talking about, but pretty close. I was on stock PD1 and flashed this in Odin with no hiccups, it's 4.4.2-based. This firmware is true engineering, and comes with absolutely no gapps or branding. Root was ridiculously simple to achieve. I used KingRoot because I had it handy on my SD Card from earlier, but I suspect you could use any of the other generic rooting apps that are out there.

The beautiful thing about this is that the kernel is permissive out of the box, and the boot partitions are insecure. I was able to install both TWRP and Boeffla's kernel via these adb commands, after unpacking them down to recovery.img and boot.img respectively:

adb push recovery.img /data/local/tmp/recovery.img

adb shell su -c dd if=/data/local/tmp/recovery.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery

I couldn't actually boot with those because Verizon's Secure Boot was still getting tripped. I figured that was in the aboot block, so I pushed one from a 900F 4.4.2 tar using the above method and it worked! The phone was on and working before and after flashing. Then I restarted...

.... Aaaand my noobness caught up with me. My phone is hard bricked now, probably because I didn't fix the aboot permissions prior to restarting, or didn't have the right PIT flashed before I pushed that.... I'll do the Qualcomm SDcard debrick trick at home tonight and keep chugging.

Anyway, the point is that this firmware's kernel is SELinux permissive right out of the box, and the bootloader is not fully secure. I'll upload this to my Google Drive shortly and share the link, for now I attached a screenshot prior to my noob-brick. I think we're almost there!
[Verizon Galaxy S 5 Android Development] GeTex:
It won't work, the 900F is a completely different chipset :/ We have been able to achieve root and flash a recovery, but secure boot still is an issue.

It's nice that it is easy to root but, i don't think it will do us any good. Lets see what others have to say.
[Verizon Galaxy S 5 Android Development] jBarnett12116:
Duh :eek: that's a great point about the different chipset. I realized that I should have tried the Sprint aboot after I'd already done the deed. Stupid noobs!!! lol

To back up a little bit, considering that the adb commands all went through... in theory, what's preventing us from flashing 900P images individually and waiting until we've flashed everything to Sprint except the aboot, then pushing the Spring aboot?

This firmware has never been published on XDA or anywhere else, and is full of security holes. I'll PM anyone the link to my Google Drive who wants to test it out.
[Verizon Galaxy S 5 Android Development] klabit87:
What we initially thought was engineering firmware was actually prerelease firmware. Which is why it doesnt have gapps or any VZW bloat.

We played around with it yesterday and there was nothing useful in this firmware.

Most kk kernels were permissive by default. So nothing special about the kernel.

And does not allow for access to raw memory which would be a great step to starting on kexec.

There are no permissions to set for aboot. The pit file is irrelevant when using dd

The brick came from cramming the g900f aboot down its throat via dd.

dd does not have any sanity checks that odin has. This is what makes root access dangerous to some people.

We are no closer to anything than we were before this firmware.

But thanks for your input and hope the debrick method works for you [MENTION=7763647]jBarnett12116[/MENTION]
[Verizon Galaxy S 5 Android Development] jBarnett12116:
Ahh OK, sorry for the intrusion. Just hadn't seen the firmware public on here and since it seemed on first pass to be much more adb friendly I wanted to get it to devs. I'll sit down now :o
[Verizon Galaxy S 5 Android Development] GeTex:
Thanks for the effort! I'll do your firmware anyways for archival purposes. It's possible that kernel may be easier for me to write a raw memory exploit. I'll take a look!
[Verizon Galaxy S 5 Android Development] GeoHogan:
If one of you guys find a legit firmware that looks like it will do us some real good I will pay for it no questions asked. I'm still very much interested in this unlock and would like to put my resources to it. PM me the link and I'll post the download of the file on this thread.
[Verizon Galaxy S 5 Android Development] ryanbg:
That's a factory build. It's different than engineering, pre-release, and userdebug. It's for provisioning and programming things like IMEI, device root key, etc... They aren't very useful unless you own a GSM shop.
[Verizon Galaxy S 5 Android Development] tag_vt:
Just signed up to share some news. Since I'm new, I can't post a URL. I'm not sure about the feasibility of implementing this, but I just saw it earlier and the S5 is on there...

If you go on slashdot and look for the post "Rowhammer Attack Can Now Root Android Devices" it says the S5 is vulnerable to a rowhammer attack. There's a link to the paper in the comments. It's well beyond my expertise, but I hope this helps.
[Verizon Galaxy S 5 Android Development] Legitsu:
please don't bother

everybody that knows about this knows about that and likely knew about it long before /. did
[Verizon Galaxy S 5 Android Development] GeTex:
We already have root... why bring it up? It's irrelevant to our discussion
[Verizon Galaxy S 5 Android Development] Legitsu:
just anouther n00b 'helping'
[Verizon Galaxy S 5 Android Development] tag_vt:
Yeah, I see my mistake. My bad.
[Verizon Galaxy S 5 Android Development] klabit87:
Have a new member.

Let's bash him and call him dumb.

Make so much sense.

If you guys read the documentation it states that it gives direct access to memory.

Yes we know about it but I don't see the need in such comments.

Besides, at first glance, it does give potential for root on mm for locked bl.

At least, I believe it's possible anyways.

Their documentation does not state what version firmware the exploit was tested against.
[Verizon Galaxy S 5 Android Development] Legitsu:
you would have a point if it wasn't every single new member every single time with the same comment/question thats been asked or posted 10,000 times

and its conceivably every linux kernel version 2.7 and higher
[Verizon Galaxy S 5 Android Development] GeTex:
I believe it won't work. If I recall discussions with jrkruse and ryanbg i am almost 100% sure that it would require the kernel to be modified(from what I understand) and that even if we change it actively in memory, I believe that alone causes issues that stop the system(since you really aren't supposed to ever touch a kernel on a running system)

I can't keep track of anything anymore. I just know MM is currently requiring I unlocked bootloaders in order to modify the kernel to allow root. Hmmm. I'll take a look

But with every 1 post user coming here and saying stuff we already know, or irrelevant stuff, we all have time wasted
[Verizon Galaxy S 5 Android Development] klabit87:
Regardless, nothing will more well happen with the s5.

Anybody that would/could do anything for it has been driven away or lost interest for one reason or another.

My s5 has been sold so good luck guys.
[Verizon Galaxy S 5 Android Development] Barabba11:
I hope we'll have a news here.. 7.1 is out and we can't install on bad luck CID11.. :(

Thank you!
[Verizon Galaxy S 5 Android Development] hauckk@sfreserves.org:
I would help but My s5 is hardbricked sorry I can't recover it because there is no Debrick IMG for the exact firmware I was on
[Verizon Galaxy S 5 Android Development] GeTex:
Please stop bumping
[Verizon Galaxy S 5 Android Development] mnorris298:
Not purposely trying to bump but does this mean people with Toshiba chips are screwed?
[Verizon Galaxy S 5 Android Development] Legitsu:
screwed,overtighted stripped and snapped clean off
[Verizon Galaxy S 5 Android Development] mnorris298:
Ugh...one can only hope that there is someone out there working on it....
[Verizon Galaxy S 5 Android Development] GeTex:
that
[Verizon Galaxy S 5 Android Development] Jen290:
sd card

Does anyone know which SD cards use the same Toshiba eMMC chip? It may allow for easier testing/dumping of firmware..

Richard successfully used beaups exploit on a SD card.

I cant post URLs so google "richard burtons changing cid on sd card"
[Verizon Galaxy S 5 Android Development] Legitsu:
[MENTION=5414005]GeTex[/MENTION] close the thread already ffs

and would the rest of you kids stay the fk off google please we know more then you do you aren't helping you are just being annoying
[Verizon Galaxy S 5 Android Development] GeTex:
Fyi, I'm not god

[MENTION=2376614]jcase[/MENTION] can this thread be locked for now? We can make a new one if anything ever happens
[Verizon Galaxy S 5 Android Development] GeTex:
This thread has outlived its usefulness. I could very well continue to try and unlock the GS5 bootloader as it is VERY good as my work phone still. The issues arising are just too much

If I must be honest with all of you I need some excellent low level people and we have a better shot trying to bruteforce the signing key or steal the Verizon signing keys and just make a simple flash me bootloader for everyone like back in the days of the GS3. I cannot really suggest much else, I have no time, I work all day and the days I'm not working I'm either dying in bed from exhaustion or trying to contact my fiancé. I don't have time to personally do this, our current best bet honestly is to do this

A user just reported beaups exploit worked on SDcards(no shock) so get an exploitable Samsung as card, change Cid, and try and make your entire system on the SD card. In theory it will work. Its really stupid and probably has garbage performance
[Verizon Galaxy S 5 Android Development] the Doctor:
THREAD CLEANED AND CLOSED

[MENTION=4908448]autonomousperson[/MENTION], if you make any further progress and would like it re-opened, just shoot me a PM.
[Verizon Galaxy S 5 Android Development] Legitsu:
what does hardware half todo with it

all you need for kexec is support for unsigned kernel modules via a modload patch and root

the rest is just coding leg work
[Verizon Galaxy S 5 Android Development] autonomousperson:
Ideas on how to hook into boot without touching kernel and bl?
[Verizon Galaxy S 5 Android Development] Legitsu:
not gonna happen without touching the kernel and afaik the only way to get selinux permissive and thus unsigned kernel modules on the G900V is to use multisystem

https://github.com/hsbadr/MultiSystem http://xdaforums.com/android/software-hacking/tool-multirom-recovery-replacement-t3102395

*which I have no idea if it even still works on recent OTA's

---------- Post added at 01:13 AM ---------- Previous post was at 01:07 AM ----------

you aren't gonna be-able to touch anything from a cold boot likely you will need to find a way to force a restart and then figure how pass your code to the BL or figure out how to chain-load the BL using kernel modules (BOC3 and lower because thats all samsung has released source for )
[Verizon Galaxy S 5 Android Development] autonomousperson:
But the BL check happens before the bl is loaded right?
[Verizon Galaxy S 5 Android Development] GeTex:
FYI, the bootloader is what forces SElinus Enforced as far as I'm aware, making it purely impossible, also loading unsigned kernels isn't possible as the bootloader verifies kernels as well. If we could have loaded unsigned kernels this whole time, i think we woulda done that over unlocking the bootloader.

Secureboot..... f***
[Verizon Galaxy S 5 Android Development] jjdavis699:
So...we're f***ed?
[Verizon Galaxy S 5 Android Development] GeTex:
Unsure, someone needs to do better research! Hence the R&D thread!
[Verizon Galaxy S 5 Android Development] Legitsu:
you can load unsigned kernel modules provided that

1. you can set selinux to permissive

2. patch the modload binary to disable signature checks

3. have source for your kernel version

4, ofc have root

and yes the checks are done pre-kernel but that doesn't mean you can't use kernel modules todo stuff

as for selinux on the s5 I am not sure what the state of it is tbh I know you could disable it on the note 4
[Verizon Galaxy S 5 Android Development] npjohnson:
Okay, to point out some things:

2. Not a binary at all, it is a script that relies on devmem2 to overwrite mem locations

3. No, not at all necessary, we use IDA 100% of the time on the uncompressed zImage

The boot image integrity checks are done pre-kernel, yeah, by aboot.

Getting SELinux permissive soudln't necessarily be too hard, but would also require some time. Why do you want modules?

Kernel modules cannot modify in any way how aboot runs, ever. There is no way to just jump back to aboot in memory. SBL set must load aboot, and all it depends on in a specific order.

No, bootloader isn't what enforces it. This can be proven on the S4 (same logic here) by running a bootloader associated with a version that setenforce no longer works with (i.e. NK1) with a kernel that allows setenforce (i.e. NC5). If it was the bootloader passing cmdline arguments to the kernel, any kernel boot would be unable to use setenforce to change SE enforcement.

We can 100% load modules, that is not a problem in the slightest, the bootloader DOES verify the boot image, but, using the aforementioned devmem overwrite method, we can easily allow module to be loaded.

And, to clarify here, an Unlocked Booloader ALLOWS you to boot unsigned kernels/recoveries. You can't load unsigned kernels/recoveries without an unlock or a LOKI like spoof (not possible on newer firmwares).

A developer edition device has an aboot that is specially made, and allows the booting of unsigned recoveries/kernels. It can not be run on a production device, however, because each developer edition aboot is hashed with the CID of the device in a special way (that isn't public). That's why the CID write allows us to boot a developer edition aboot.
[Verizon Galaxy S 5 Android Development] Legitsu:
don't you sorta need kernel source to build modules against ?

or do you just patch the addresses ?
[Verizon Galaxy S 5 Android Development] autonomousperson:
I dont think anything kernel related will get this to work. This check seems to occur before the BL is even loaded if that makes sense.
[Verizon Galaxy S 5 Android Development] Legitsu:
I don't think there is any getting this to work
[Verizon Galaxy S 5 Android Development] autonomousperson:
1) Vendor codes

2) Vzw's signing keys xD
[Verizon Galaxy S 5 Android Development] GeTex:
Lol ignore, i found a way
[Verizon Galaxy S 5 Android Development] doubleaykay:
Found a way to do what?

And also, I think there is some confusion here... The kernel stuff being discussed is for kexec, other stuff for the vendor commands.
[Verizon Galaxy S 5 Android Development] Legitsu:
probly change selinux to permissive

which I know is possible
[Verizon Galaxy S 5 Android Development] doubleaykay:
OK. I know there was a way to do it back on 4.4.2 but aside from the AT&T S4 I can't think of any other device that has downgrade rights so that specific method may not apply...
[Verizon Galaxy S 5 Android Development] Legitsu:
either way having a a unlocked aboot means we can play around and it would make implementing kexec a lot easier e.g you can boot a kernel compiled with more debug options and get more usable output easier
[Verizon Galaxy S 5 Android Development] btonetbone:
OK, so here's a question. I'm not a developer, but would really love to get my bootloader unlocked and a fast, lightweight AOSP ROM on my phone. While I can't offer any coding help, I'm a good talker and a sneaky sonofabitch with no shame. I'm happy to call up Toshiba Semiconductors and see if I can talk my way into some vendor codes. But...here's my question. What exactly am I asking for?
[Verizon Galaxy S 5 Android Development] Legitsu:
not gonna happen

we aren't even sure if there is even the ability to change CID on Toshiba NAND

ya know it occurs to me there are several people in this thread that seem to have not read beeups pdf in its entirety

the so called 'vendor' commands are not something Toshiba would have

it would be Samsung and the reason for the existence of cmd62 which is what allows the CID to be changed is likely for Samsung use SPECIFICALLY for hashing the boot loader to provide "developer editions"
[Verizon Galaxy S 5 Android Development] thewebsiteisdown:
Just a question thought if you will. Is there any way to get a toshiba chip developer edition? I'm guessing no but was wondering.

I have a white 15 now which is mine and my brother now has a unlocked black one. My wife's is black and is 11... I'm thinking they just did a limited amount with samsung in the beginning and then switched to toshiba at a certain point.
[Verizon Galaxy S 5 Android Development] GeTex:
I'm working on getting venodr commands and instructions to dump firmware, thankfully, my relations at Toshiba may come in useful, trying not to tell them I'm exploiting it but... We shall see
[Verizon Galaxy S 5 Android Development] InsaneHype:
If the "11" chip does get unlocked what might Samsung/Verizon do go combat users doing it, or can they do anything to relock the bootloader in same method as updating, but forced?
[Verizon Galaxy S 5 Android Development] autonomousperson:
Does someone know the series of the gs4 toshiba chip or have a link? [MENTION=5414005]GeTex[/MENTION] Gl on that firmware dump, I think they use the 8048/8051 controller so we will have to read up on assembly.

https://en.wikipedia.org/wiki/Intel_MCS-51

https://drive.google.com/file/d/0B7YRGiy0yEM4QVBjc24xQ0ZadTA/view

They do have an integrated controller so we would need to know what it is if we wanted to decompile a compiled firmware,
[Verizon Galaxy S 5 Android Development] autonomousperson:
they could push a firmware update for the eMMC to stop CID reprogramming but I dont think they would bother with that
[Verizon Galaxy S 5 Android Development] Dudash:
All I can see them doing is blacklisting the CID we are using to make our phones Dev Editions.

That would mean it could prevent our phone from booting the ROM if it detects the CID.

I don't think they would but it is verizon..
[Verizon Galaxy S 5 Android Development] autonomousperson:
That's unlikely as it is not a permanent solution. Changing the CID again would then let it become a dev edition device again. It is much more likely that they would do a firmware patch for the eMMC. But even that is very very unlikely.
[Verizon Galaxy S 5 Android Development] GeTex:
Yeah, I have a library now of 8 Dev CID's so... We are bulletproofing.

But they could just udated to 5.1.1, meaning new users could NOT get root and couldn't unlock.