yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Struggling to get this to work on the T280.

How are you extracting the signature from the boot.img?

I modified and compiled unpackbooting to unpack the boot.img and extract the signature.

I then compiled the boot image with degas-mkbootimg without changes and flashed it with odin.

Same crap 'secure check fail'

Next I tried with your seandroid.img. Same story.

Also I compared the T280 original boot.img with yours and there is a significant size difference. The T280 image is almost double the size.

I tried to flash your boot.img with odin which also failed. [emoji53]
[Samsung Galaxy Tab A series Questions & Answers] jedld:
The images I have are for the SM-T285, I am still trying to get my SM-T280 image tested. I can upload that one if you want. Noticed that the SM-T280 bootloader image is a little different but similar (has pre padding). Unfortunately I don't have the device so I'm working blind here.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Yep I know they are from the T285, but what method did you use to create the signature image?

If you upload the patched boot.img I'll try it out.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
For the signature image I just used a hex editor and copied from the start of the SEANDROIDENFORCE string until it reaches the end.

I'm curious if in place editing of the ramdisk using abootimg -u will work here though, like try to add a test file in the root dir. I'll be uploading my file in a moment
[Samsung Galaxy Tab A series Questions & Answers] jedld:
[MENTION=4899305]ashyx[/MENTION] Here are the patched 280 files, one is pre padded like the stock image. try both and see if anyone of them works. I feel there is more to the SM-T280 image though, I'll do a hex diff later and try to reverse engineer it. I guess SM-T280 users will have to wait a little while.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Tried both, but both still give the 'secure check fail' error... However the padded version did boot and has the modified ramdisk.

This had me confused because I had already done exactly the same previously by patching both header and footer, but always got the 'secure check fail' error so always assumed it had failed and didn't allow it to boot.

I have just checked a boot.img I previously created and it Damn well booted!

I just wasn't allowing it to.

So it seems all we need is the header and footer patched in and we're golden even if the boot loader does flag the 'secure check fail' warning.

I have already patched unpackbootimg to extract the signature. Just need to do the same for the header.

Then the same for mkbootimg.

Not had chance to check root yet as I deleted all my rooted images, but I'm pretty confident it will work.

I'll do that later when I get home from work.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
awesome! There isn't much I can do for the SM-T280 on my side though without access to the hardware. But knowing that the bootloader is unlocked like the T285 is a relief.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Well the bootloader is still locked, it just seems we've dropped lucky and it's not as strict as other devices.

Im pretty certain this wouldn't work on higher end devices which do use crc signature checking.

Thumbs up for the hardwork you've put in.

Can't believe I was almost there and just missed one step.

Ah well perseverance paid off.

Just don't tell Samsung lol. [emoji6]

On a side note does your device display the 'secure check fail' message too?
[Samsung Galaxy Tab A series Questions & Answers] jedld:
As long as I keep my SEANDROIDENFORCE header intact at the end the warning doesn't show
[Samsung Galaxy Tab A series Questions & Answers] klemen241:
Hello, i am here and i will test everything you need for t280, sorry i was sleeping haha
[Samsung Galaxy Tab A series Questions & Answers] jedld:
nice, I'll be sending you a rooted SM-T280 ROM for you to test :)
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
So no red text at all saying 'secure check fail: boot'?

Strange how things would differ between the 2 devices.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Yup no warning, no nothing it is as if I flashed an official image.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
On second thought I haven't checked if there are warnings during heimdall flash as I've set it to auto restart after flash so it may be too fast for me to see. There is certainly no warnings during boot up time though.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Nothing at boot just initial boot.img flash.
[Samsung Galaxy Tab A series Questions & Answers] mingkee:
May anybody make a version for T280 (Wi-Fi only)?

I am hesitant to buy because there's no root solution.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Just having my SM-T280 image tested and I'll up the link if it passes.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
confirmed. Just flashed the cm-12.1 cyanogenmod recovery using the same methods as boot and it booted up. The screen resolution is just a little bit wonky. but it looks like porting over twrp should be possible.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
So it sounds like the procedure to root this device now that you guys have most of the steps figured out is to flash the modified boot rom, flash twrp once it's ported, then hopefully use chainfire's SuperSU?
[Samsung Galaxy Tab A series Questions & Answers] jedld:
tried it again with the --no-reboot flag and yes the error also shows up on mine
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Well I already have the Tinker Edition V5 custom rom pre-rooted (just visit the thread). Though having twrp would allow us to use chainfire's SuperSU script which does a better job of installing SU than the one I installed on V5 by hand.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
I'm definitely looking to keep the stock rom on my T280 so the easier the install the better. It looks like [MENTION=4899305]ashyx[/MENTION] has experience with making TWRP ports so maybe he's already working on it.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
certainly hope that is case :)

there is nothing technical stopping us from making that happen on these devices, just time and effort. On my part I am having problems compiling twrp 5.1 branch on my cm sources, nevertheless this is a problem I believe only I have, I'd assume ashyx already have this covered.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Not sure if this matters but the Samsung devices I have been using normally use TWRP versions between 2.8.7.0 to 3.0.2.0.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
pre-rooted rom for the T280 should now be available at the Tinker Edition Thread. I you want to remain with the stock rom you probably will need to wait until a custom recovery (twrp) is built for this device.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Here you go see if you have any luck getting this to flash as Im having trouble. The recovery is fine, but patching the header from stock recovery causes ODIN to hang on RQT_CLOSE !!

I have no issues if I do the same procedure with stock recovery.

I haven't tried directly flashing the image with DD or any other tools as I haven't rooted yet. I wanted a working recovery first to back up DATA.

I'm giving up for now as its time for me to turn in.

http://www.mediafire.com/download/ekhbttobr26esbe/T280_twrp_recovery.tar
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Sweet, thx [MENTION=4899305]ashyx[/MENTION]. I will give this a shot in a couple of hours. I assume the modified boot.img is required to flash as well, correct?

---------- Post added at 04:35 PM ---------- Previous post was at 04:23 PM ----------

If someone has the stock boot.img and recovery.img for the T280 handy, can you post a link. I want to have them on hand if something gets borked.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
In theory you can just try flashing the recovery alone and see if it works. Just not sure if the stock boot will try to overwrite the recovery when it starts...
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Where is the stock boot getting the stock recovery image from after a modified recovery has been flashed?
[Samsung Galaxy Tab A series Questions & Answers] jedld:
There is a recovery patch file stored in /system. For this device though, I doubt that it would touch a modified recovery but I'm not sure.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
OK I decided to bite the bullet and just root the damn thing. Luckily everything booted and data still intact.

Still no luck with recovery. Tried DD to flash the image which went fine, but still no boot.

I'm a little perplexed as to why patching the header isn't working.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
So I flashed the recovery file provided by [MENTION=4899305]ashyx[/MENTION] and after the reboot it just came back to stock recovery so I'm guessing [MENTION=649003]jedld[/MENTION] your suspicions were correct. I'm hesitant to flash the boot image without a stock one on hand. Having trouble locating a good copy of stock rom.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
I got cyanogenmod recovery to boot on the SM-T285, problem is the display is rotated upside down. Might be some settings I missed.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
I was able to flash your twrp image using Odin without any issues.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Do you have the T285?

Is TWRP booting?
[Samsung Galaxy Tab A series Questions & Answers] jedld:
[MENTION=4899305]ashyx[/MENTION] TWRP wont boot on my SM-T285 using your packaged kernel. Using the stock recovery kernel and combining it with the ramdisk that you provided resulted in a bootloop instead. Not sure if it works with the T280
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
At least you can actually flash it. No such luck on the T280 because of that damn header.

Did you swap the DTB too?

If Samsung haven't disabled it could you get the last_kmsg after attempting to boot twrp?
[Samsung Galaxy Tab A series Questions & Answers] TopTongueBarry:
[MENTION=4899305]ashyx[/MENTION] TWRP wont boot on my SM-T285M either using your packaged kernel, however, it does flash via odin successfully. I didn't bother doing any further testing, and put the stock recovery back on the device for now.

TTB :)
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Can ensure it does actually flash? Disable auto reboot and look for the 'secure check fail' message in red which means probably not.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
I have the T280 and although the flash went through just fine... TWRP did not boot. It just reverted back to stock recovery.

---------- Post added at 08:44 AM ---------- Previous post was at 08:40 AM ----------

This is a possibility for me as well. I am going to have to double check it when I get home.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
The problem is, for whatever reason, Samsung decided to add some sort of header to the T280 boot and recovery images. Whereas the T285 has a normal android header.

Somehow the recovery.img needs to be patched with this header but so far all attempts are unsuccessful.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Well, not sure if this would matter but I did not flash the modified boot.img because I can't find a stock boot.img for the T280 as a recovery option in case it gets stuck in some kind of boot loop. The tablet is actually my daughters and if I mess it up, I will reap the wrath of a 7 year old, not about to go there.

if the boot.img is required along with the recovery.img then I'll need to keep looking for stocks.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
You won't need the boot.img. However you'll be just fine with the modified boot.img. It boots just fine. If you get issues I can always upload the stock image.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
[MENTION=4899305]ashyx[/MENTION] Was finally able to boot twrp on my SM-T285 using the ramdisk you provided, however I had to swap the kernel with the one I compiled from source. It works, the only problem now is that the display is inverted.

I'm trying to compile twrp myself to add flip screen flags, though I am still in the process of getting an OMNI based build env running, twrp just won't compile on my cm sources.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
I take it you made the kernel permissive when built from source? That's usually the reason twrp doesn't boot.

If you can give me a screenshot of the display, so I can see what needs flipping I can modify the config and rebuild.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Here you go: http://imgur.com/a/RarEQ
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Have added the flag for inverting the display. Compiled it with kernel built from latest sources. Kernel was a bit bigger which was slightly worrying.

Display colours should also be correct.

TWRP_3.0.2-1_SM-T285_23916

.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Thanks! Flashed it and twrp now works properly for me. The kernel I built was a bit bigger too. I'll try to go back to stock and try to re-root my ROM from there. Thanks again!
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
You two are doing great work. Keep it up!
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Ok, everything went well, was able to revert back to stock, install root using twrp adb sideload SuperSU and was rooted again.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Does this version have any better chance of working with the T280?
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Not until me and jedld can figure out how to patch that header. There is something I'm going to try when I get chance.

I'm so busy at the moment I'm having very little time to work on anything.

If anybody wants the permissive custom kernel I can upload it.

---------- Post added at 08:00 PM ---------- Previous post was at 07:34 PM ----------

Im guessing that means MTP is not working? I have a fix for that
[Samsung Galaxy Tab A series Questions & Answers] jedld:
[MENTION=4899305]ashyx[/MENTION] - Reversed engineered the 280 header and came up with the following notes:

The header is 512 bytes long.

First 8 bytes consists of magic - 0x44 0x48 0x54 0x42 0x01 0x00 0x00 0x00 - DHTB

This is followed by a sha256sum of the payload. Note that the "payload" starts with the start of the ANDROID header until the first 20 bytes of the SEANDROIDENFORCE header

Followed by 4 bytes which I think is unused and then followed by a 32-bit unsigned integer consisting of the size of the payload.

After that it is mostly empty bytes as far as i can tell.

This is true for both boot and recovery headers.

Below is the sample header of the DHTB header of the T280:

< 00000000: 4448 5442 0100 0000 4b40 f348 e206 7672 DHTB....K@.H..vr

< 00000010: 8fe4 72c2 06ed 0fdd 9df7 16d7 80d0 fc64 ..r............d

< 00000020: 17bd 6594 5881 07b2 0000 0000 0000 0000 ..e.X...........

< 00000030: 1498 d600 0000 0000 0000 0000 0000 0000 ................

We can see that payload is 14063636 long, original boot.img is 14064808 long, the seandroid header is 680 bytes long so we do the math

14064808 - 512 (Size of the DHTB header) - 680 (seandroid header) - 20 (we include the SEANDROIDENFORCE magic string)

=

14063636 = 0x00d69814 , then swivel to account for endianess 0x1498d600

afterwhich I computed the sha256sum of the 14063636 byte payload and got 4b40f348e20676728fe472c206ed0fdd9df716d780d0fc6417bd6594588107b2

which matched the checksum value.

Hope with this information, T280 users can get what they deserve so much :)
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Thanks, that was great info.

I'd noticed the header magic was the same in the boot images and recovery after doing binary comparisons.

I'd assumed that somewhere in the header would be the checksum and I'd already created a checksum from the payload and then tried to search for it in the header and footer, but came up with nothing. However I didn't include the SEANDROIDENFORCE magic string, which makes sense now as the rest is the signature. When you pointed that out I did it again and sure enough a match in both the header and footer.

Good catch too with the bytes containing the payload size didn't notice that. Again found this in both header and footer.

Looks like these are required mainly for ODIN to flash. If not there the bootloader rejects the flash which is why it was hanging on RQT CLOSE!

I calculated the checksum and converted the payload size to HEX and patched the header and footer.

Tested this out by modifying the stock recovery which wouldn't flash beforehand with the same mods. Bingo it flashed and didn't hang on RQT close! Still get the 'secure check fail' warning, but I guess that has something to do with the signature.

Next I moved on to the custom kernel. I recompiled with some slight mods and did the procedure again with the stock recovery, replacing the stock kernel with the custom kernel.

Flashed...and boom...successful flash again and booted.

Next up was TWRP for the same treatment, did the whole procedure again and used my custom kernel. Flashed with ODIN and didn't hang this time. Booted to recovery and the result was...

SUCCESS!

TWRP now available for the T280.

Still needs tweaking as the graphics aren't the right colour seems to be using the wrong pixel format and the FSTAB may need adjusting as the EFS is showing 0mb. All easily fixable.

.
[Samsung Galaxy Tab A series Questions & Answers] mingkee:
Good!

It's about time to get T280.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
http://xdaforums.com/showthread.php?t=3475381

Sometimes the GUI can get a little laggy, like tapping a button and nothing happening, just wait. Think this is related to the kernel, looking into it.

.
[Samsung Galaxy Tab A series Questions & Answers] venomrat:
The same goes for TWRP for the T285 also.

Thanks for your hard work. :good:
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Getting Secure Check Failed (recovery) when flashing via Odin 3.09.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Yeah, that happens. but it should get flashed anyway even if that error shows up.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
That's what I thought it would do but it still has stock recovery.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
Yeah, happens to me too. I think it is most likely something with the gpu/graphics, isn't that big of a deal though.
[Samsung Galaxy Tab A series Questions & Answers] mingkee:
Can I modify or delete the following after rooted?

1. delete /system/csc/languages.xml

2. modify /etc/hosts (required by adaway)

If I could do both, I will buy T280 this week.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Uncheck autoreboot.

After flashing twrp and odin says pass you need to immediately boot to recovery. Don't allow it to boot to the OS or recovery gets replaced with stock.

---------- Post added at 09:29 AM ---------- Previous post was at 09:29 AM ----------

Of course you have root.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Ok. I will try that tonight.

Does that mean that every time the unit boots into the OS that recovery will be overwritten or is it just the first time?
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
The first time you boot to twrp it will patch a script in system to prevent recovery being replaced.

This only needs to be done once.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Even with all of the progress both of you have made with the T280/T285, is the bootloader still considered locked?

Just asking because I wanted to use Magisk for systemless root and xposed.

Thanks
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
We can make whatever modifications we need to by patching the boot.img.

However I have written confirmation from Samsung that the bootloader is locked on the T280. Also others have had the same confirmation.

The T280 is a little more difficult to circumvent the apparent locked bootloader than the T285.

You should still be able to use Magisk, however Magisk modifies the boot.img and this would break things on the T280, not sure about the T285.

Even so after Magisk patches the boot.img we can fix the issue.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Ok, it sounds like I am going to try and load Magisk this evening once I get TWRP working. How do you recommend we move forward when it comes to fixing what Magisk will modify?
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
You have a T280?

After installing twrp immediately make a full backup.

When that's done install magisk then reboot to recovery.

Make a backup of the boot partition with twrp then upload it.

Restore your boot image made earlier in the backup.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Correct, I have the T280. I will do as you suggested and report back.
[Samsung Galaxy Tab A series Questions & Answers] jedld:
For the T285 after reverting to stock boot and system, I've been able to make magisk work with xposed and phh supersu, enough to be able to play pokemon go (xposed and supersu still needs to be disabled before you start playing though)
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Even after unchecking auto reboot in Odin, the flash is now failing and on the device it says: Secure Check Fail: (recovery) Custom Binary(recovery) blocked by FAP Lock.

Booted back into stock recovery.

Just to be clear, the flash is taking place while the device is on the download screen correct? (vol-down, home, power)

---------- Post added at 07:04 PM ---------- Previous post was at 06:57 PM ----------

Sorry, brain fart... forgot to enable oem unlock. TWRP flash was successful.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
[MENTION=4899305]ashyx[/MENTION] As requested.

I flashed Magisk v6 and phh superuser 17 for Magisk.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Here you go: boot_magisk_v6_sm-t280

.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Would the boot image be messed up if I tried to add systemless xposed?
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
No shouldn't be as long as it's magisk compatible. It will be installed within the magisk system.
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Great! I'll give it a shot this evening.

Additionally, do you know which of chainfire's SuperSU zip files I can use with TWRP to root this device traditionally? I tried the usual 2.76 and it boot froze. Had to put the stock boot image back.
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
Why would you want to install supersu with magisk installed?

If you mean without magisk you need to install the 2.78 version below then flash the padded boot image in post #32

http://xdaforums.com/apps/supersu/v2-64-2-66-supersu-mode-t3286120
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
I wouldn't... this would be if I didn't use Magisk. I am always just tinkering with the hardware and trying different things is just fun.

But thank you for the info... if I wan to use SuperSU in lieu of Magisk, I will use 2.78 and the padded boot.img. Thank you!
[Samsung Galaxy Tab A series Questions & Answers] EdGe7x:
Your Magisk boot image works like a charm and I was able to install topjohnwu's 86.5 systemless xposed without any issues!

Thank you!!!
[Samsung Galaxy Tab A series Questions & Answers] travieso1208:
Hello thank you guys for all your hard work. I wanted to ask, does the padded boot file work also on the SM-T280 version ?
[Samsung Galaxy Tab A series Questions & Answers] ashyx:
It is for the T280.
[Samsung Galaxy Tab A series Questions & Answers] travieso1208:
Ok thank you