yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy Note 3 General] bftb0:
I think that is all normal. The only thing which affects the runtime link is

LD_PRELOAD=libsigchain.so:libNimsWrap.so

I'm not running OF1 so I can't check that, but CM13 has only

LD_PRELOAD=libsigchain.o

One thing to watch out for is that dynamic linker messages are famous for "red herring" error messages; the most stupidly obvious one acts like this:

$ ./myprog

./myprog: not found

what it really meant is that some supporting dynamic library that got recursively pulled in by the linker is missing. Similarly, the "PIE" message might be about a library, not the "unlock" program.

I gues you could try re-running it but type this command first:

export LD_PRELOAD=libsigchain.o

Also, it goes without saying that you should be using a root prompt ("su" first), and the "./unlock" binary should be executable, (e.g. "chmod 755 ./unlock")

---------- Post added at 08:46 PM ---------- Previous post was at 08:21 PM ----------

@shallman

If you continue to experience the same issue, you might have to dig a little deeper to figure out what is going on - meaning, you'll end up watching the dynamic load process by the linker in a step-by-step way.

There is a famous Unix/Linux tool called "strace" which can capture all the calls that an application program injects into the kernel, and see success/failures

here is a version compiled for the ARM architecture which should be statically linked.

The way you would use it would be like this:

(get both "strace" and "unlock" to /data/local/tmp (or similar place) and put your soon-to-be-overwritten SDcard in the slot)

su
cd /data/local/tmp
chmod 755 strace
chmod 755 unlock

./strace -f -o /data/local/tmp/strace_out.txt ./unlock

chmod 644 strace_out.txt

This will produce a (potentially massive) text file "strace_out.txt" which will have a text line for every system call from the ./unlock program into the kernel. (You might want to pull it back to the PC with "adb pull" in order to look at it if it is big - I find looking at big files on the phone to be a pain in the butt).

You'll be able to see the dynamic loader hunting around to find files, and finally finding them ( "open()" calls will succeed with a filehandle number instead of a -1)

Most importantly, you will probably also see exactly when and where the "PIE" messages are occuring - my guess is it will be with a specific library.

"strace" has saved my bacon many many times when something misbehaved.

.
[Verizon Galaxy Note 3 General] shallmann:
I tried export LD_PRELOAD=libsigchain.o and after entering chmod 777 unlock I got:

WARNING: linker: could not load library "libsigchain.o" from LD_PRELOAD for "chmod"; caused by library "libsigchain.o" not found.

I'll try strace when I have time and report back if I find something. Thank you for your time and help bftb0!!
[Verizon Galaxy Note 3 General] bftb0:
Oops. Sorry man, I misspelled - libsigchain.so

( My idea there was that somehow "libNimsWrap.so" was causing the problem - if it wasn't needed during preload it could be omitted. That's speculation on my part though. )

strace will provide more detail. Note that some ROM builds provide it as a standard component (I'm not sure if stock does) - do a "which strace" in a terminal shell to see if you already have it before bothering to download it.

If omitting libNimsWrap.so in the "export" command doesn't work (you'll get a bunch more error messages), make sure you put it back in place before collecting diagnostics using strace. e.g.

export LD_PRELOAD=libsigchain.so:libNimsWrap.so

vs

export LD_PRELOAD=libsigchain.so

PS if you want to display a big long text file (e.g. the strace output file), the native formatting of the forum software is sort of clunky for that, and it clutters things up. So, either attach it as a file, or better yet put it in a pastebin dump and provide the URL.
[Verizon Galaxy Note 3 General] shallmann:
With typo corrected (sorry, I should have caught that) in the export LD_PRELOAD=libsigchain.so I'm back to the PIE error. I made sure I put the libNimsWrap.so back, I'm getting some sort of permission error with strace. I checked in Root Explorer, both strace and unlock are 755. Here's the text file for what it's worth:

31440 execve("./unlock", ["./unlock"], [/* 29 vars */]) = -1 EACCES (Permission denied)

31440 write(2, "./strace: exec: Permission denie"..., 34) = 34

31440 exit_group(1) = ?

31440 +++ exited with 1 +++

---------- Post added at 06:47 PM ---------- Previous post was at 06:46 PM ----------

I think it may have something to do with accessing the SD card. I'm trying to figure this out on my own....not that I'd refuse help lol
[Verizon Galaxy Note 3 General] bftb0:
strace should not be trying to access the /sdcard with the instructions I gave you

Your output above suggests that unlock didn't have it's file mode bits set to execute, or the current filesystem is mounted with a noexec option, or... a SELinux problem that somehow prevents the "strace" executable from performing an exec.

Can you use strace to do something simpler, eg

./strace -f -o stracehello.txt echo "hello, world."

All these files should be in /data/local/tmp (def not on the /sdcard)

Check with the "mount" command to see if /data is mounted with a "noexec" option (that would be weird)

(A) are you running as root?

(B) are both the strace and unlock files set to mode 755?

(C) set the permissions on /data/local/tmp to be world-writable

(D) all files are in /data/local/tmp ?

(E) do a long listing of tmp, tmp/strace and tmp/unlock to show both their owner/group and SELinux attributes:

cd /data/local

ls -ld tmp tmp/strace tmp/unlock

ls -ldZ tmp tmp/strace tmp/unlock

su

cd /data/local/

chmod 777 tmp

cd tmp

chmod 755 strace

chmod 755 unlock

echo PUT YOUR JUNK SD CARD IN THE SLOT

./strace -f -o straceout.txt ./unlock
[Verizon Galaxy Note 3 General] shallmann:
Thanks once again for your time, patience and help. The tmp folder permission change to 777 results in:

u0_a239@hltevzw:/ $ su

root@hltevzw:/ # cd /data/local/

root@hltevzw:/data/local # chmod 777 tmp

root@hltevzw:/data/local # cd tmp

root@hltevzw:/data/local/tmp # chmod 755 strace

root@hltevzw:/data/local/tmp # chmod 755 unlock

cho PUT YOUR JUNK SD CARD IN THE SLOT <

PUT YOUR JUNK SD CARD IN THE SLOT

/strace -f -o straceout.txt ./unlock <

./strace: exec: Permission denied

1|root@hltevzw:/data/local/tmp #

I copied the text from the terminal emulator; it's not showing the first character on some lines.

Also:

u0_a239@hltevzw:/ $ su

root@hltevzw:/ # cd /data/local

s -ld tmp tmp/strace tmp/unlock <

drwxrwxrwx shell shell 2016-08-24 13:06 tmp

-rwxr-xr-x root root 778892 2016-08-24 12:01 strace

-rwxr-xr-x root root 16928 2016-04-25 09:11 unlock

s -ldZ tmp tmp/strace tmp/unlock <

drwxrwxrwx shell shell u:object_r:shell_data_file:s0 tmp

-rwxr-xr-x root root u:object_r:shell_data_file:s0 strace

-rwxr-xr-x root root u:object_r:shell_data_file:s0 unlock

root@hltevzw:/data/local #
[Verizon Galaxy Note 3 General] bftb0:
I guess it must be a SELinux thing going on. Everything else looks OK.

as root, you could try a "chcon" on the two files to see if that helps

su
cd /data/local/tmp
chcon u:object_r:system_file:s0 unlock
chcon u:object_r:system_file:s0 strace

and see if that makes any difference.

I'm assuming that when you run ./unlock it still appears to start up (but gives those PIE errors).

Just to make sure we haven't missed something, please recheck the "unlock" md5sum signature. I believe you tried diddling it with that patcher utility previously - hopefully you are using the original right now.

PS I am assuming (from what you have written) that OF1 does not have a pre-installed version of "strace" (in /system/xbin, /system/bin, or /system/sbin), is that right?

---------- Post added at 01:30 PM ---------- Previous post was at 01:03 PM ----------

@shallmann

You can keep trying the above to see if it helps, but it just seems like we must be overlooking something simple that makes your setup different from everybody else's.

Because, others on OF1 have used this exact binary without any of the troubles you mention; so they must be doing something just a little bit differently.

How about this: have you replaced the Yemen root with SuperSU?

I suppose (especially if the Yemen tool uses an online attack server) that the Yemen root could have actually changed recently.

There are a lot of messy details with the way that SElinux interacts with the su proxy/daemon, so if you didn't replace root, I suppose it is quite possible that your "root shell" is operating with a different SELinux context that what is normally experienced with a different "su" You can find out it's current selinux context with the "id" command.

su
id

the output of the "id" command should show not only the userid and all the groups you belong to, but also the SElinxu "context".

Assuming that no custom recovery is available, installation of SuperSU from a market app download (or .apk install) "bootstraps" its own installation into place by using whatever root is already present - and then it replaces that root with it's own.

If you didn't do that, maybe that's worth a try - get rid of the Yemen root by replacing it with SuperSU, reboot, and try this ./unlock again.

Other than

- Odin Stock Flash of OF1

- Yemen Root

what else did you do between the above steps and trying the unlock method? Any other tweaks like Xposed or other root-aware application installs?

PPS are you doing this with adb or in a terminal emulator?
[Verizon Galaxy Note 3 General] shallmann:
Even if I never unlock this stupid bootloader. ...I wanna buy you a beer.

For all your troubles.

The first thing I do after rooting any device is install Superuser and Superuser Pro.

I tried chcon. Now I get 'only position independent executables (PIE) are supported. ' A little different error.

I did triangle away after the first root. Not since. I started with adb but for some reason I connect my phone to the computer (winblows 10) initially it connects as an installer. But within a minute or two it changes to media device, BY ITSELF. Very frustrating. So I've been using the terminal emulator out of necessity. Also:

u0_a239@hltevzw:/ $ su

root@hltevzw:/ # id

uid=0(root) gid=0(root) context=u:r:init:s0

root@hltevzw:/ #

---------- Post added at 10:48 PM ---------- Previous post was at 10:41 PM ----------

I wonder if there's something specific to the stock rom I'm using that's off. I'm going to try downloading another and flashing. I'll let you know. THANKS for all your time trouble and patience. I mean it about buying you a beer!
[Verizon Galaxy Note 3 General] bftb0:
We'll get it done, let's just keep at it.
[Verizon Galaxy Note 3 General] shallmann:
HOLY SH*T BATMAN MY BOOTLOADER IS UNLOCKED!! HELL to the motherf****** YEAH!! I used unlocked_n3 from the original post. Let me know where to send that beer!!
[Verizon Galaxy Note 3 General] bftb0:
[MENTION=7579765]shallmann[/MENTION]

Congrats and enjoy. And be careful too :D

Instead of the beer just help somebody else out.

Now I've got to go around and correct every post where I said "use [MENTION=1923941]donc113[/MENTION] 's binary from post #218"

Probably my fault you had to spend so much time on this in the first place.

cheers
[Verizon Galaxy Note 3 General] shallmann:
As you wish. And thank you again. I don't mind spending time tinkering, in fact I love it! :good::good::good:
[Verizon Galaxy Note 3 General] zte x500 score:
alright.. im having problems and need help please.. when i copy and paste the first command and hit enter i get.. "cannot stat 'unlock_n3' : no such file or directory"

i have all the corect files in the corect place.. which is just the unlock_n3 file in the minimal adb folder.. correct? did i do something wrong did i not do something?? help please and thank you
[Verizon Galaxy Note 3 General] bftb0:
[8/24/2016] Based on the report by shallmann starting here, it now appears that the version of the unlock binary that you choose for unlocking the bootloader of your SM-N900V depends on your firmware/OS revision. This is due to at least 3 independant technical issues. In summary, however:

For OB6, OF1:

- ryanbg's updated binary "unlock_n3" (2016-08-04) 23,432 bytes

XDA post: OP here

MD5: 0bcb409af65e311ce4b67faf7ed3f0af

The above generally applies to most people who continued to update their phones with new OTA firmware as those releases became available. Note that this binary and download link is mentioned in the middle of that post - it is not the older attachment to that post. If you encounter errors relating to PIE (Positiion Dependent Executables), this is the binary you should be using.

For people who "held back" their software updates:

For NK1 or any prior version (NJ6, NC4, NC2, MJE, MJE, MJ7, MI9)

- donc113's version "unlock" (2016-04-25) 16,928 bytes

XDA post: here - post #218

MD5: ea856efcb7de0ca8ff428522dbdc0267

.
[Verizon Galaxy Note 3 General] shallmann:
Awesome work dude. I can't express how much I've missed having a non-stock ROM on my phone. As well as my gratitude for your hard work and all the other people that work hard so people can modify their phones how they want.
[Verizon Galaxy Note 3 General] donelam304:
Wow. I am soost on this. Lol. I root'd and rom'd my note 3 when Biggins came out with 4.4.2 and haven't done anything since. This is gonna be a challenge. Lol.
[Verizon Galaxy Note 3 General] bftb0:
Nah.

[A.1] Unlock first. (Go no further if you can't). If you are on 4.4.x, use the version of the unlock tool from post #218 in the unlock thread.

[A.2] Verify you are really unlocked by looking at the Odin/ Download screen; it will say "Mode: Developer" if you are unlocked. (Go no further if you don't)

Make all your normal backups. TiBu + SafeStrap (all slots)

[C] Get backups copied off the phone someplace

[D] Optional : Backup your entire SDcard to PC.

If you are going to use a tool like Flashify to flash a recovery, switch to stock slot if you are using a Safestrap system. Before you do the recovery flash. If you know how to flash a recovery like a real man (dd it to mmcblk0p15) this doesn't matter.

[E] Boot to your newly installed recovery (e.g. twrp-3.0.2-0-hltevzw-4.4.img). Make yet another backup, including your modem and efs partitions. As before, get a copy of this off the phone.

[F] Go crazy flashing whatever you want. The steps above [A]-[E] allow you to get back to where you are now if you don't like what you find.

Use meaningful folder names when you back up so you know what they are a year from now.

Bear in mind that with an unlocked bootloader you can flash a custom recovery in Odin. So (a) don't over-write that unlocked bootloader, and (b) don't Odin flash pure stock again to try and resolve any troubles that come up.

good luck
[Verizon Galaxy Note 3 General] 26kito46:
help me!!!

Do you understand the implications of these warnings?

(Yes/No)

yes

[+] CID at boot time is/was: 11010030333247453404d525f504c100

[-] don't try this on non-samsung eMMC, seriously.

10|root@hltevzw:/data/local/tmp #

further, nothing happens:(
[Verizon Galaxy Note 3 General] bftb0:
This method does not work on units that have a CID beginning with 0x11.

Sorry.
[Verizon Galaxy Note 3 General] 26kito46:
perhaps there is another way?

sorry my english is bad

---------- Post added at 03:05 PM ---------- Previous post was at 02:57 PM ----------

:confused:

I am going to set N900VVRUDNK1 android 4.4.4

then put recovery Safestrap

and after set custom firmware.

all this will be successful?

what is better to install the firmware? with help Safestrap

sorry my bad english...
[Verizon Galaxy Note 3 General] bftb0:
Yes and No.

The "eMMC" flash memory chips that are in this phone do not have a "CID" value in them until they are programmed to have one. When they are singulated off the semiconductor wafer they are all in an identical condition.

So it is 100% certain that the chip CID value can be programmed - by the chip manufacturer.

Reading the "CID" value is part of the mandatory behavior of the public specification for eMMC flash memory chips. But a public spec for writing that value is not given in the spec - so it can vary from chip maker to chip maker. (Besides that I believe it is supposed to be a read-only value anyhow)

The first two digits of the CID (e.g. 0x15 or 0x11) identify the chip manufacturer.

In this case, the 0x15 manufacturer had a bug that needed to be field-repaired, and they released some (private) documentation that accidentally contained instructions on how to change the CID value. That is how this exploit came about - for the phones that had 0x15 eMMC chips only.

Samsung chose this keying material (the CID value) for unlocking developer edition phones so that it would be unique to a single phone - you couldn't just copy the aboot partition from a developer edition phone to a retail phone in order to convert it.

That alone indicates that Samsung expected that CID programming operations would remain private - or at least "obscure".

The hack here was to change a phone's CID value to that of a single device - a developer edition device - and then apply the signature from that device. In effect, turning many retail phones into copies of a single developer device.

Having said that, many chip makers will sell whole wafers to manufacturing partners who perform their own chip packaging & programming. So it is my guess that the information you are looking for - "how do I change the CID value of an 0x11 eMMC flash memory chip?" - is out there floating around at a variety of companies. Probably there are unscrupulous individuals that would be willing to sell that information.

Theoretically you could mount a "fuzz" attack against a 0x11 eMMC chip (using a programmer box or development board) to try and independently determine private programming modes of that chip. Doing that however is not only a monumental task but you might also "brick" hundreds of eMMC chips trying that. Looking for document leaks or paying someone for the information is likely to be quicker and less expensive.

good luck

---------- Post added at 07:48 AM ---------- Previous post was at 07:46 AM ----------

I am not sure if Safestrap ever worked on NK1 ... you should check that point very carefully.
[Verizon Galaxy Note 3 General] 26kito46:
---------- Post added at 07:48 AM ---------- Previous post was at 07:46 AM ----------

N900VVRUCNC4 this firmware will work safestrap?
[Verizon Galaxy Note 3 General] bftb0:
Yes I believe so.

However, there is an anti-rollback technology used in these phones that prevents you from flashing some older bootloaders.

This post gives the trip points where this anti-rollback occurs. If you have previously flashed any version of stock firmware of version NK1 or higher, you will be unable to flash NC4.

.
[Verizon Galaxy Note 3 General] fiverings:
Ryanbg : is the above method & files the newest revised ones? And do you do run the 2nd set of files twice.
[Verizon Galaxy Note 3 General] act5860:
Worked like a charm first time! Thanks :)
[Verizon Galaxy Note 3 General] fiverings:
I put in the adb entries and I keep getting errors about adb shell, shows up in red on super su. One time I got to the end of first section, phone shut off, but never turned back on. Help please

fiverings

---------- Post added at 10:37 AM ---------- Previous post was at 09:59 AM ----------

Can someone tell me, do you put phone into a download mode or any mode or just plug it in and start adb and enter scripts.

And when you do it the second time, you pull battery boot it up and put it in what mode?

Any help would be greatly appreciated

fiverings
[Verizon Galaxy Note 3 General] donc113:
It won't reboot automatically once it shuts down, you use just the power button to reboot. There is no need to pull the battery.

The developer option for USB debugging should be on for adb to be able to connect to your phone. No other special startup modes needed. But you DO have to be rooted and you DO have to run the unlock program twice and the 2nd time thru... It WILL OVERWRITE the SD card in the slot above the SIM. Having an SD card there is mandatory
[Verizon Galaxy Note 3 General] fiverings:
After it went through the first time it didn't reboot so I wasn't exactly sure what to do. It did say that it did everything it was successful. What I did was to install flashing and install TWRP successfully. So what should I do now . What will happen if I try to install a second time. Or do I install just the second part. It seems to be working ok. Do I have to uninstall everything and start over. How do I tell if I'm really rooted. The SD card is still in.

Thanks for your help

fiverings
[Verizon Galaxy Note 3 General] bftb0:
This thread is about unlocking the bootloader, not rooting.

In order to run the exploit successfully, you must **already be rooted**.

To check to see if you successfully unlocked the bootloader, boot into Odin/Download mode - it will say "MODE: DEVELOPER" at the bottom of the lines of text in the upper left hand corner of the screen.

(Also, you will be actually able to boot a custom recovery such as twrp; if you installed a custom recovery without unlocking the bootloader you will get the "unauthorized software" message on screen when you attempt to boot the custom recovery)
[Verizon Galaxy Note 3 General] fiverings:
I used Arabic Tool successfully, then installed Super SU . Then I ran the unlock bootloader , it got thru first part ok. But phone didn't reboot so I unplugged phone. Tried to run second part of the unlock, didn't work. Installed flashify and installed TWRP. Can I run the whole bootloader unlock with TWRP installed or do I have to remove TWRP ?

Any help would be appreciated.

fiverings

I ran the unlock program again the second time it went through nice and even rebooted after the second part. So I think I'm good.

Fiverings
[Verizon Galaxy Note 3 General] InfinityR:
Weird, every time I try to do it, then flash a custom recovery, a message from Verizon shows up and says to take it to the store.

Why can't you make this easy, samsung/VZW
[Verizon Galaxy Note 3 General] fiverings:
That is weird, never saw anything like that before. Are you sure your rooted. Put phone into recovery and read what says, near bottom it should say developer.

Good luck
[Verizon Galaxy Note 3 General] InfinityR:
Aha! I fixed it, instead of running everything through ADB, I had success running thru terminal on the device.

Running CM13 now! :D
[Verizon Galaxy Note 3 General] jtjj127:
Awesome... Works Great after the 2nd Try...
[Verizon Galaxy Note 3 General] satzg:
overwrote unlocked bootloader

Well I overwrote the unlocked bootloader. It would appear odin won't let me revert to stock though I was able to put the stock recovery back but cannot get a stock system.img.ext4 flashed. Tried to upgrade to the 0f1 modem and bootloader trying to debug a cm13 kernel oops. Guessing this phone is toast now. Too bad as cm13 on the n900v was looking really good. Do I have any options to get this phone back? Thanks.
[Verizon Galaxy Note 3 General] hutchjim:
I have a Verizon note 3 but my numbers start with 11 not 15 why?
[Verizon Galaxy Note 3 General] donc113:
Because Samsung, like most manufacturers, used eMMC chips from different suppliers, thus different starting digits in the cid which denote the manufacturer of the eMMC chip. The 'backdoor' exploit only works on those chips that start with '15' in the cid.