yashsingh1/xdaforums huggingface dataset:
[Sprint Samsung Galaxy S7 Edge Questions & Answers] crowly100:
I disabled these two as per your instruction,

Today I got a Software Update notification saying download unavailable. It wants me to update via wifi. I disabled notifications on google play services but the notification is still present. Is there anything I can do to get the notifications to stop? By disabling these two weren't the updates not supposed to come through at all?

Thanks
[Sprint Samsung Galaxy S7 Edge Questions & Answers] UnixSlayer:
Don't forget these two as well....

Sent from my unrooted #BootLoaderGate SM-G935T
[Sprint Samsung Galaxy S7 Edge Questions & Answers] crowly100:
Great thanks, that seemed to do it. Do I need google services notification off as well?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] UnixSlayer:
No need to stop Google app updates.... just be careful of the Samsung apps update.....

Sent from my unrooted #BootLoaderGate SM-G935T
[Sprint Samsung Galaxy S7 Edge Questions & Answers] crowly100:
Glad you said that I have been updating the Samsung Apps, so don't do that anymore correct?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] treepog:
Ok, so if the 4 items mentioned are disabled we wont get the Samsung apps updates either? Or is there something else we have to disable or do to stop the Samsung apps updates??

Thanks in advance
[Sprint Samsung Galaxy S7 Edge Questions & Answers] sirslipzalot:
Guys, if Samsung is actively watching XDA, don't you think any exploits should be discussed in PM rather than openly? At least until its completed and ready to be released? Seems like open discussion would be dangerous to the project at this point.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Surge1223:
I don't think they care or even monitor xda. There is literally nothing in this thread that can even remotely be called code for an exploit.

Xda mostly doesn't have threads where anyone discusses code in-depth. And if there are threads like that they get buried by more popular and less significant threads, like "how to run Xposed on mm" or "steps to get android pay to work" If I was Samsung and i saw threads like that in developer only areas, I would have no worries at all.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] CVertigo1:
Agreed. This is the one reason that off topic chatter can be helpful lol. Too bad off topic does more hurt than good.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] spyderdreams:
[IMG="Unlock tool"]http://i.imgur.com/lCyVrwf.png?1[/IMG]

Maybe if I get the software to someone that can get the cable?

[IMG="KNox"]http://i.imgur.com/BSNF6Hc.png[/IMG]
[Sprint Samsung Galaxy S7 Edge Questions & Answers] rotondo2k:
Could this work for the tmobile variant of the s7 edge to unlock the bootloader as well because i dont understand this method to much lol.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] rotondo2k:
im kind of slow when it comes to rooting and unlocking devices so maybe it can be explained much easier
[Sprint Samsung Galaxy S7 Edge Questions & Answers] LeftyGR:
There is currently no method of root to to explain. For any us device.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fazzix:
Somebody should make a video
[Sprint Samsung Galaxy S7 Edge Questions & Answers] billydroid:
A video of what?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] ali87va:
Stay on topic and read through the forums guys,there's no root method whatsoever!
[Sprint Samsung Galaxy S7 Edge Questions & Answers] konoplya:
thread becoming a crapshow again..
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
Well it's not much to talk about. The developer said he wasn't releasing the exploit until next week
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
But that doesn't mean we can just start typing useless post, right .. leta just keep it civil and on-point, if we can.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] ali87va:
Developer never stated an ETA unless you're talking about the release keys for the nexus they hacked into.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
Yes I'm referring to the qualcomm keys
[Sprint Samsung Galaxy S7 Edge Questions & Answers] brendan802:
This thread was nothing but a sh!tshow from the beginning.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] melona380:
EXPLOIT IS OUT

http://bits-please.blogspot.com/2016/04/exploring-qualcomms-secure-execution.html#more
[Sprint Samsung Galaxy S7 Edge Questions & Answers] melona380:
Possible root

This Compiled C file Should elevate you to root "in Theory" from adb terminal:

Compiled from: https://github.com/laginimaineb/standalone_msm8974

WILL TRIP KNOX

Again NOOB Developer

I'm not responsible for any thing you do!!!
[Sprint Samsung Galaxy S7 Edge Questions & Answers] rotondo2k:
So basically using this method i can root my tmobile s7 edge device??
[Sprint Samsung Galaxy S7 Edge Questions & Answers] rdeets:
Can anyone verify that the above method works?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Son Rise:
How would u flash this?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] milojoseph:
Lol how do you flash when we don't have root
[Sprint Samsung Galaxy S7 Edge Questions & Answers] SkyAttacksX:
Guys the code was from a month ago - this is nothing recent . I wouldn't advise blindly trying this . Wait for a skilled developer to give more insight .
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
Also the developer said tomorrow he is releasing more information on exploits tomorrow, and basically confirmed the bootloader can be unlocked using this method but it requires a certain kernel. So do not upgrade to the latest firmware just in case the kernel was updated!!!!!!

http://bits-please.blogspot.com/2016/04/exploring-qualcomms-secure-execution.html?m=1#more
[Sprint Samsung Galaxy S7 Edge Questions & Answers] canynballa:
Can I flash the old firmware to downgrade? I only ask because I could with my S5
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
I think you can .. not sure tho ..

---------- Post added at 04:23 PM ---------- Previous post was at 04:18 PM ----------

[MENTION=4517211]Xileforce[/MENTION] may be you can have a look at this, make a Odin flash able kernel with the exploit loaded in it .

The exploit is out btw .. I hope we can finally have some.good things.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] melona380:
This is a compiled c file in a zip... similar to an exe you don't flash this. Only mess with it if you know what you are doing.

1. Extract onto internal storage

2. Chmod 755 executeme

3. ./exexcuteme

If you don't understand these directions, DO NOT ATTEMPT!
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jdidtht:
Anyone run it yet.?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
Have u achieved root with this ..
[Sprint Samsung Galaxy S7 Edge Questions & Answers] DetoxVenom:
I did this and it soft bricked my phone, when I reset my phone I wiped dalvik, and retried and got a temporary root with tripped Knox. Then my phone crashed and lost root, Knox still tripped.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jdidtht:
Interesting, so so close
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Son Rise:
How did u do it
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jdidtht:
Probably as stated above
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
Thank you for your braveness . Perhaps [MENTION=631273]Chainfire[/MENTION] can help us with his magic touch ..
[Sprint Samsung Galaxy S7 Edge Questions & Answers] sirslipzalot:
What firmware were you on when you tried it?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] DetoxVenom:
Apd3
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
That's the latest right . I am on T-Mobile soninwoulfnt know . Maybe we on a bit older firmware can give it a shot .
[Sprint Samsung Galaxy S7 Edge Questions & Answers] rdeets:
So... Does each carrier have a different firmware designation? ie: APx#?

I'm on AT&T and have APE1. I'm sure AT&T doesn't have a more up to date system than T-Mobile, so, does...

APD = T-Mobile

APE = AT&T

Etc?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] sirslipzalot:
No. The numbers and letters represent the date it was released I think.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] AceDaMack:
I'm on stock tmobile I'm so tempted to try this but this is my only phone.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jdidtht:
The sprint guy just had some soft brick and achieved temp root tripped knox rebooted and was gone and Knox was still tripped it's very close
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
Which method did you use? The zip our stand alone kernel? The developer mentioned the following [MENTION=631273]Chainfire[/MENTION]

These are some other big boys developers, that may help since this impacts multiple phones. There's a name on the list that will tell us directly, even if it breaks our hearts :) [MENTION=3333221]trailblazer101[/MENTION] [MENTION=4854133]bajasur[/MENTION] [MENTION=854355]scrosler[/MENTION] [MENTION=5868929]hsbadr[/MENTION] [MENTION=2376614]jcase[/MENTION] [MENTION=4395895]BeansTown106[/MENTION] [MENTION=3669069]idler1984[/MENTION] [MENTION=3975929]zxz0O0[/MENTION]

I totally forgot about the "standalone" version of the older TZ exploit. In any case, I just cleaned it up a little bit and put it up on github, here: https://github.com/laginimaineb/standalone_msm8974

It relies on the previous kernel exploit (https://github.com/laginimaineb/cve-2014-4322/tree/master/Feud/jni) to get kernel code execution, and then dynamically finds the needed kernel symbols and does all the work without needing a kernel module.

You should definitely check out Ghassan's version as well! I just found out about it, but looking at the code it looks very clean and easy to use.

Ghassans code...

I have re-written his original zero-write exploit as a standalone kernel module here: https://github.com/ghassani/qc-tz-es-activated-exploit

Sources

http://bits-please.blogspot.com/2016/04/exploring-qualcomms-secure-execution.html?m=1#more
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Milly7:
Can you elaborate more? You said you reset the phone and wipes dalvik? How so? Stock recovery doesn't have the option to wipe dalvik, at least not on the T-Mobile version. Also, how was temp root verified? You had SuperSU or another super user app? Did you execute anything requiring root privileges?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] brendan802:
Now this thread is going somewhere. Im trying this as soon as I get home.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
I have no clue how to make any .sh file ..may be something like the the previous guy made for us would.help ..
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
I'm not even sure what you guys are trying to accomplish
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
Just give it some time boys and girls. The founder of this exploit is releasing more information tomorrow that will in his words help unlock the bootloaders. Whatever you do just don't update your firmware.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
Root .. I believe ..
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
First step would be to check if that phone is even vulnerable, i have doubts
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Son Rise:
Help us babyboyy
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
Some guy was able to attain temp root .. not sure .. but this whole exploit thing might actually affect pretty much all devices running Qualcomm processors. I might be wrong.

May be u can have a look at his blogspot.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
I just did, i suggested a starting position
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
No it won't unlocked the s7 bootloader, and I doubt he indicated that

Link? I dont see the exploit as is working on this device. Knowing the researcher, he is also very pro responsible disclosure. Knowing Samsung security, they are really pro "patch known bugs". Odds of anything responsibly disclosed being live in it are low.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] ^I'm_With_Stupid:
jcase makes a good point. Better to wait until tommorow when we'll have more information and will actually be able to determine which phones are vulnerable before going crazy and attempting things that might brick your phone.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
Go back a page .
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fmmatrix95:
The guy on post #354 achieved temporary root using the zip in post #341
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
Yeah lemme know what i find and believe it or not i think i found a root method but won't say anything yet but involves using files from the LG G5 and Cross editing the s7 aboot.mbn files...i flashed modified files directly and it didnt flag it after u correctly sign the files
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
If anyone has any donor phones messed up lmk im only going to flash mine when i know it wont completely mess it up and its my primary lol
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
New update some how i added a folder to the / dir and i have no fkin clue how i ran a fk ton of scripts because i got mad and something made a blank script in the root dir..so now i have hope just now to find what worked
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fordstang99:
I actually ran that on my sprint lg g5 and it was about resetting some default parameters
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
Im guessing the snapdragons on the other phones have the same codes or atleast close..so thats hope atleast i need like 2 or 3 broken s7's so i can try direct flashing...cant tell a jtag no worse case sinerio is remove the cpu from a s7 and put a g5 in...if im not mistaken the msm8996 has 3 fuses that all can be blown to be never unlocked...ive never went that crazy but im pretty sure that means there is 3 points on the cpu that are not soldiered in order to make a *fuse* which then if u try flashing so far u fk it up and only way to fix it is a cpu life and reseat/flash
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
ROOT GAINED!!!
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
no errror omg
[Sprint Samsung Galaxy S7 Edge Questions & Answers] beachbumsurfs:
Your are awsome. LTE working and data? Did knox trip?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] dhonzik:
It would be interesting to know if a safe rooting procedure can be developed by this method
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fordstang99:
I almost want to take back my lg g5 and get the edge
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Kevin36:
Honestly you are the best truly a God like android deliverer of freedom
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hella356:
Root achieved? Really? If so, would this work on the T-Mobile variant, the non-Edge S7, specifically?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jdidtht:
If it does indeed work, once we see the method I guess us tmobile folk will find out
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fordstang99:
Heh ill be taking my lg g5 back for the sprint s7 edge
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Kevin36:
All i know is that this guy will have some good change in his pocket for his hard work
[Sprint Samsung Galaxy S7 Edge Questions & Answers] mrjaydee82:
I'm willing to try the method out on a tmobile variant...I just got the phone yesterday so if I mess something up I have a backup phone and will just exchange the device at tmobile. Pm me or hit me up on hangouts Jason Slapp is the name
[Sprint Samsung Galaxy S7 Edge Questions & Answers] Ramer:
If root was really gained, why is it buried in a thread that has no relevance to root? ?
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
unfortunately this day and age, i cant just take a word on something without knowing the person, or seeing evidence
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
That exploit is for MSM8974 according to the readme. The SD820 (which i think this phone is?) is MSM8996

I dont believe this
[Sprint Samsung Galaxy S7 Edge Questions & Answers] brendan802:
I will try his root and post back what happens whether it hard bricks soft bricks or actually gives root without issue. Im backing sh!t up now and then diving right in
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fmmatrix95:
You are totally right about the difference in the versions, however that doesnt mean this exploit cannot work because probably both of the cpu versions use the same trustzone methodology or security.

Again I might be wrong, but we need to try.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
That's why I added you. I hate it and love it, but the one thing I can expect from you is honesty. Thanks for dropping in
[Sprint Samsung Galaxy S7 Edge Questions & Answers] ^I'm_With_Stupid:
Exactly. The guy who found the exploit confirmed it works on the 6p, the nexus 5 and the moto G 2nd Gen.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
I've been following this guy for two weeks. You're correct he turned over his findings to the appropriate areas last week. He gave them a week before publishing to his blog. Again his own words.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
Actually it kinda does mean that, look at the exploit. Odds of the TZ image for one MSM8974 device and one MSM8996 device have all the same addreses for fuction pointers,

So, lets look at the exploit. Now I'm basing this on assuming that what i remember is right, that this phone has the MSM8996 not MSM8974.

All the addresses (or most, i havent actually looked that much) in the source are hard coded. That exploit is expecting a certain kernel, at a certain layout in memory.

#ifndef __SYMBOLS_H__
#define __SYMBOLS_H__

// SYMBOLS FOR THE MOTO X 2ND GEN

//The address of the kallsyms_lookup_name function within the Linux kernel
#define KALLSYMS_LOOKUP_NAME (0xC01D2AA4)

//The DWORD that needs to be nullified in order to pass all bounds checks
#define BOUNDS_CHECK_DWORD_ADDRESS (0xFE8236A4)

//The address of the DWORD which is returned when querying fver_get_version with version code 0
#define VERSION_CODE_0_DWORD_ADDRESS (0xFE823D64)
#define BOUNDS_CHECKS_RANGE_START (0xFE82CA10)
#define BOUNDS_CHECKS_RANGE_END (0xFE82CC0C)

//The address of the tzbsp_get_diag function pointer
#define TZBSP_GET_DIAG_POINTER_ADDRESS (0xFE8299B8)

//The address of the tzbsp_security_allows_memdump pointer
#define TZBSP_SECURITY_ALLOWS_MEMDUMP_POINTER_ADDRESS (0xFE829A38)

//The address of the pivot used
#define MOV_SP_R0_LDMFD_R4_R12_PC (0xFE847C34)

//The address of the BX LR gadget
#define BX_LR (0xFE8097AC+1)

//The address of the "LDR R0, [R0,R1]; BX LR" gadget
#define LDR_R0_R0_R1_BX_LR (0xFE80CE86+1)

//The address of the "STR R0, [R1]; BX LR" gadget
#define STR_R0_R1_BX_LR (0xFE809E66+1)

//The address of the "LDR R1, [R1]; STR R1, [R0]; BX LR" gadget
#define LDR_R1_R1_STR_R1_R0_BX_LR (0xFE808D5A+1)

//The address of the gadget used to set the DACR
#define SET_DACR (0xFE80FCE8)

//The address of the address cache invalidation gadget
#define INVALIDATE_INSTRUCTION_CACHE (0xFE80F858)

//The address of the getTTBR0 gadget
#define GET_TTBR0 (0xFE817BA8)

//The address of the setTTBR0 gadget
#define SET_TTBR0 (0xFE817BB0)

//The address of the memcpy function in TZ
#define TZ_MEMCPY (0xFE8150A4)

#endif

So, yeah, even IF that TZ was vulnerable (im not sure it is), that exploit isnt written for that kernel, but another one.

No way that exploit code lead to a root on this device assuming the linked source matches the compiled exploit, and assuming the device is MSM8996.

It is literally written for a specific device/tz kernel on a different CPU.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] pantmunu:
Oh well, another one bites the dust.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] stang5litre:
Found this. Hope this pans out

http://xdaforums.com/verizon-s7-edge/how-to/root-unlocked-bootloader-update-t3392841
[Sprint Samsung Galaxy S7 Edge Questions & Answers] TechBSwift:
Same info bro, wait to see what pans out
[Sprint Samsung Galaxy S7 Edge Questions & Answers] stang5litre:
Sorry didn't know it was posted in this page.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] DetoxVenom:
Kernel

---------- Post added at 01:51 AM ---------- Previous post was at 01:48 AM ----------

I used the root flash fire all module to wipe the dalvik on temp root, before crash.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] melona380:
I got the same result. As soon as we mod the image, the system on reboot causes a soft brick wanting you to flash official firmware. This will get you a temporary root if you are a developer and you want to learn more about how it verifies the image that's about all it's good for unfortunately.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fmmatrix95:
Ok, so this confirms that zip file works for temporary root. Ofcourse you will softbrick your device on reboot after root because the bootloader is still locked. Is there anyway to use the same exploit to unlock the bootloader instead of rooting the device?

I'm not a developer so i might be talking like a noob but i m just curios.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] billydroid:
JCase answered these questions a page back or so.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] melona380:
[MENTION=2376614]jcase[/MENTION] try playing with this one

https://github.com/ghassani/qc-tz-es-activated-exploit/blob/master/main.c
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
No way possible the src linked previously to me lead to root on this phone. ZERO. NONE.

Why, it isn't compatible with this phone. Read the readme and source.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] fmmatrix95:
Since there is no proof that you actually gained temporary root other than your words, is there anyway you could prove that to us (screenshots of root checker or something similar)
[Sprint Samsung Galaxy S7 Edge Questions & Answers] DetoxVenom:
I don't have root anymore sorry, I'm not trying to get anyone to believe me, and I'm not trying to trick anyone. I also don't encourage any of these new methods of root to anyone, until a dev gives it OK. I was only stating that I had a little bit of luck, sorry to disappoint.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] mackentosh:
No need to explain, you're going to always have critics and doubters hear and there. You're contributing more than most of the critics anyways......
[Sprint Samsung Galaxy S7 Edge Questions & Answers] hellsgods91:
at this point we said fk it and went with jtag methods...so far 5 phones fried and 2 broken to rage throws...and if anyone wants to be a **** and make stupid comments we could of kept all info found and not shared **** more then what most have shown....were not devs and not programmers....bored hobbists trying to help everyone....found out the system that is being used is just a modded out note4 rom with recoded to work with MSM8996 and with a display model that has a unlocked bootloader you can obtain a dev licence like the s5 dev edition so if any risky sprint/att carriers that work in store want to get ballzy please make me a dump or any rom or info in general would deeply appreciate it or a base s7 with no service and never activated or branded basically not touched at all and direct boot to the bootloader would help out a **** ton.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] dazednconfused:
What info has been shared other than statements with no proof. This entire thread has been a joke from the beginning.
[Sprint Samsung Galaxy S7 Edge Questions & Answers] jcase:
Jtag is disabled on this device, as it is on most modern phones.

Display ones don't have unblocked bootloaders.