yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy S 5] zeewox:
I released a PoC to run custom boot/recovery on SM-G900A with firmware G900AUCS4DQB1.

But don't flash any custom ROMs from TWRP since bootloader is still locked.

Please see https://github.com/frederic/SVE-2016-7930

I would be interested by your feedbacks.
[AT&T Samsung Galaxy S 5] AptLogic:
So with this exploit, I would have to connect my phone to my PC every time I want to reboot into TWRP?
[AT&T Samsung Galaxy S 5] zeewox:
Exactly
[AT&T Samsung Galaxy S 5] AptLogic:
So if we were to rig up this exploit to instead run a new kernel, we would have the same issue, right? If so, do you think we'd be able to find a way to remove this handicap?
[AT&T Samsung Galaxy S 5] NavSad:
Will it work with other firmware's?
[AT&T Samsung Galaxy S 5] wforider:
Welcome back
[AT&T Samsung Galaxy S 5] zeewox:
Correct. This is a runtime memory corruption: phone flash is not modified.

---------- Post added at 10:05 PM ---------- Previous post was at 10:03 PM ----------

This firmware is the latest vulnerable version.

For older versions, you'll have to port the shellcode.
[AT&T Samsung Galaxy S 5] NavSad:
How do we apply the patch into the source tree?
[AT&T Samsung Galaxy S 5] zeewox:
I've updated instructions with the patch command
[AT&T Samsung Galaxy S 5] Cullub:
I'm not sure how far fetched this is, but possibly we could just make sure everything was a soft reboot, and never actually shut off power. I don't actually reboot my phone personally more than once a week if that, and for the most part it isn't so the phone doesn't use battery, it's to reset all the Samsung junk that slows down the phone.

Does the kernel control what the physical buttons do?
[AT&T Samsung Galaxy S 5] samccfl99:
I do not understand a word you guys are talking about...LOL :confused:. I would be happy to get my OA1 BL back!

I HATE AT&T. They should just provide an UNlocked BL for this phone already. EVERY other variation has been unlocked already. Wow, I just checked the ATT website and they don't even sell the S5 or S6 anymore...:rolleyes:

THEY SUCK!!! but I keep watching this thread anyway...maybe someday... :D
[AT&T Samsung Galaxy S 5] AptLogic:
[MENTION=2828892]zeewox[/MENTION] would it be at all possible to leverage the old futex exploit to force a kexec module into the kernel without breaking chain of trust? I understand that this differs from your runtime exploit by far, but is it possible? Because then all that would really be left to do would be to build something like safestrap around it (like they did with BootMenuManager on the old Atrix 2)
[AT&T Samsung Galaxy S 5] Guicrith:
Yes, you can use the futex exploit to write kernel memory from userland, so you could have kexec as an app and chain of trust would not matter since the device has already booted up past the checks.

Best way would be to overwrite the invalid opcode exception to jump to a kexec routine stored in ram then call an invalid opcode.
[AT&T Samsung Galaxy S 5] NavSad:
Futex has been patched.
[AT&T Samsung Galaxy S 5] AptLogic:
Yes but that doesn't stop us from using the exploit to our advantage on the experimental firmware.

We got root with it, chances are we can force kexec as well... All we need is someone who knows how to develop the exploit, because some of this stuff is going way over my head lol.
[AT&T Samsung Galaxy S 5] Guicrith:
I dont know much about the futex exploit other than it granting full R/W access to RAM, but if anyone has written C example of futex with an init, read byte and write byte function I can write the kexec.

I am an emulator developer and deal with HW registers and physical address based RAM access all the time.
[AT&T Samsung Galaxy S 5] wforider:
https://www.rapid7.com/db/modules/exploit/android/local/futex_requeue

---------- Post added at 02:28 PM ---------- Previous post was at 02:25 PM ----------

http://www.cvedetails.com/cve/cve-2014-3153
[AT&T Samsung Galaxy S 5] AptLogic:
Will this suffice? https://github.com/timwr/CVE-2014-3153
[AT&T Samsung Galaxy S 5] Guicrith:
Yes, that looks fine.
[AT&T Samsung Galaxy S 5] Guicrith:
The url is here for anyone wanting to help or follow development.

https://github.com/meepingsnesroms/UserLandKexec

I currently need help with inline asm, since I am using the invalid opcode interrupt to switch to supervisor(kernel) mode, I need to set where to go after.

Since arm vectors are actually opcodes(as far as I can tell, its very hard to find good documentation since there are so many arm variants)

https://stackoverflow.com/questions/6139952/what-is-the-booting-process-for-arm

The opcode I am putting in the vector is "MOV PC(R15), R0" so after the jump it will go to the address in R0, but I have to backup and write to R0 from C with inline asm.(I am aware supervisor R0 and usermode R0 may be different)

So before calling the invalid opcode I need to set R0 to the C variable "void* new_pc" but I keep getting weird errors about an "=" sign when compiling could someone help me with this?(I am entirely new to asm as well since my main goal with emulation is universal compatibility of all programs and asm only works on one platform.)
[AT&T Samsung Galaxy S 5] Guicrith:
To be clear, the error is a compiler error about assigning a C variable to a CPU register, not to another variable.
[AT&T Samsung Galaxy S 5] invert_nexus:
It's been awhile since I've played around in assembly, but looking around at various sources and have a couple of possibilities.

1. Is it possible that you have to add r0 to your clobber list? I don't see why you'd need to in the initial read from r0 into old_ro. But maybe in the write from new_pc to r0? Sounds good although you mentioned the = which makes me think it's referring to the =r...

2. Maybe it should be +r not =r? Doesn't seem right, but it's the mention of the problem with = that leads me here. Some issue with your use of constraints...

Just a couple of observations from a neophyte.

---------- Post added at 06:46 PM ---------- Previous post was at 06:23 PM ----------

Hmm.

Something else.

Do you need to have the extra colons to differentiate between an output and input operand?

I.e.

asm volatile ("mov r0, %[value]"

:
: [value]"r" (new_pc)
:"r0"
);

Something like that?
[AT&T Samsung Galaxy S 5] Guicrith:
Its compiling now, Thank You.

Is there any heimdall version that works to flash an S5 because trying jodin3 and heimdall 1.4.0 dont work since I use a mac not windows.
[AT&T Samsung Galaxy S 5] AptLogic:
Try using a Windows 7/8/8.1 VM and ODIN.

Or better yet just image a flash drive with FWUL and use jodin3 from there https://www.androidfilehost.com/?w=files&flid=142115
[AT&T Samsung Galaxy S 5] AptLogic:
[MENTION=4759484]Guicrith[/MENTION] got a status report for us?
[AT&T Samsung Galaxy S 5] S5ATT4life:
S5 ATT 5.0 running AllanceRom

My issue's are.

No 4G LTE

Samsung keyboard before I begin to text I get " unfortunately keyboard has stopped working"

In alliance control I cannot download themes in "View and download themes" tab it just hangs in there.

What are my options or work arounds? Should I be using a different rom? Thanks.
[AT&T Samsung Galaxy S 5] samccfl99:
Yes, use TMS5 3.0 or Phoenix or Twi5ted. I only used that Alliance back in 2015 when LP first came out for our phone. I did not like it.

https://xdaforums.com/att-galaxy-s5/development
[AT&T Samsung Galaxy S 5] Guicrith:
I cant install the exploitable firmware because I dont use windows and I dont think jodin/hiemdall will work with an S5, my mac sees the device attached and connects but locks up on installing the firmware, to me that says the driver works but the software does not.

Also I am having issues with emulation as romhacking.net is about to implode and needs to be backed up very soon.

Another thing that is new to me is dealing with the MMU as game consoles only run one thing they so dont have one.

I need to change the memory mapping so all virtual addresses match there physical address otherwise only kernels that have the same initial load location as the stock kernel will be able to boot since the load location would not be accessible from the application.
[AT&T Samsung Galaxy S 5] STraver:
Diagnostic Mode?

When I follow the directions in the first post and Odin the experimental firmware, my phone reboots into some kind of factory diagnostic mode. How am I then to install the apps and follow the rest of steps 2 and 3? Any help is appreciated!
[AT&T Samsung Galaxy S 5] starmint:
towelroot no longer supported?

So this guide is no longer applicable?
[AT&T Samsung Galaxy S 5] DragonS5:
This root method should still work and is still applicable, when you install towelroot, supersu, and flashfire make sure you have all the apks transfered on board the device and install as 3rd party apps. Hope that helps
[AT&T Samsung Galaxy S 5] starmint:
towelroot

i just keep running across info that says towelroot no longer works on any phone so any root method that involves it is now outdated?
[AT&T Samsung Galaxy S 5] technohunter123:
We are first downgrading to a very old KitKat experimental firmware which works with Towelroot, and then flashing back up to a semi modern firmware with root kept.
[AT&T Samsung Galaxy S 5] Cullub:
Have you tried a VirtualBox vm with Windows installed on it? Otherwise you might be able to pick up a used Windows machine on Craigslist, or there are some cheap ones on eBay. If you'd like, I could set up a croudsource something (or, even better, you could), and us here on XDA could probably contribute a few bucks for the cause.
[AT&T Samsung Galaxy S 5] Old School Joe:
First THANKS AptLogic, I was able root my G900A in like 15 mins.

I searched but not sure, three questions:

1) Since this post is there way to get the rooted phone forward to 6.0.1 ?

2) Is 6.0.1 really any better than the 5.0 rooting rolls you back to ?

3) Is there a custom ROM that is based on 6.0.1 ?

The reason I ask is because I only run one app that requires rooting, not a must have for me

Thanks, us older guys struggle to keep up with all the life hacks LOL

Joe
[AT&T Samsung Galaxy S 5] Guicrith:
I am not here to beg for money or free gadgets.

Currently I can not continue work on this project as I feel I am not experienced enough and no longer have the motivation.

Although if someone has a question I will answer it and provide proof if possible.
[AT&T Samsung Galaxy S 5] AptLogic:
1. You can flash your phone back to 6.0.1 at any time using ODIN, but be aware that this will wipe your data!

2. Not very much. If you get a good custom ROM on the device, you can have a much more fluid device and a longer-lasting battery.

3. Not at this time since we can only create 5.0-based custom ROMs. We would love to create 6.0.1-based ROMs, but the Kernels won't allow it.

Basically, if you want root on this phone, your only hope is to use 5.0.

Hope that answers your questions!
[AT&T Samsung Galaxy S 5] Old School Joe:
There are so many, can you recommend one? I don't want crashes, more stable is better :eek:

Thank You for making this possible
[AT&T Samsung Galaxy S 5] AptLogic:
If you want a slim and fast TouchWiz experience, I recommend the X ROM: https://xdaforums.com/att-galaxy-s5/development/rom-xtrestolite-g900a-edition-extras-t3525205

If you want a highly customizable and stable TouchWiz experience, the you should go with TMS5 https://xdaforums.com/att-galaxy-s5/development/5-0-oc7-tms5-1-0-4-29-15-t3095987

If you want an experience that comes as close to AOSP as possilble, then go with AptOS: https://xdaforums.com/att-galaxy-s5/development/aptos-t3564641
[AT&T Samsung Galaxy S 5] ChikhaiBardo:
So I downloaded the root tools package and Windows Defender keeps popping up saying it contains;

Trojan:Win32/Skeeyah.A!rfn

I haven't even unpackaged the RAR and Windows is freaking out. Anyone else experience this?

Edit --

Sorry I didn't give more details. Windows 10 Home. This is the file;

https://www.androidfilehost.com/?fid=673368273298935990

roottools-s5v3.zip
[AT&T Samsung Galaxy S 5] AptLogic:
What operating system are you currently using, and which zip is it exactly? I can fire up one of my virtual machine tomorrow and see if I can replicate the issue.
[AT&T Samsung Galaxy S 5] ChikhaiBardo:
Sorry I didn't give more details. Windows 10 Home. This is the file;

https://www.androidfilehost.com/?fid=673368273298935990

roottools-s5v3.zip
[AT&T Samsung Galaxy S 5] AptLogic:
Ah.. could just be Windows Defender throwing a fit at towelroot (Defender isn't really all that great, it's just meant to "be there" until you can get actual antivirus). Nevertheless, I will test it myself in the morning as soon as I've got a Windows 10 machine rigged up.
[AT&T Samsung Galaxy S 5] ChikhaiBardo:
Yea this is the only machine I have access to at the moment. I'm currently working remotely in the middle of nowhere Brook's Range Alaska, and was just trying to pass sometime and finally root my phone while I had access to speedy internet. I figured it was something silly with Windows Defender (brand new machine and install) I don't usually deal with Windows often on my Gentoo machines at home :good:
[AT&T Samsung Galaxy S 5] AptLogic:
Ah. If you want actual antivirus, I'd recommend Avast. It's free and works decently with little impact on performance.

If I find the same issue you're having tomorrow, I'll most likely just tell you it's a false positive and then call Microsoft to report the false positive (I don't think they'd really care though lol). I have a general idea of what's making Defender throw a fit, but unless you want to dive into isolating individual files and testing them one at a time, I wouldn't worry about it.
[AT&T Samsung Galaxy S 5] ChikhaiBardo:
After Avast scan

This is the result of scanning the roottools-s5v3 archive with Avast;

It does not mention anything about a trojan as Windows Defender implied.
[AT&T Samsung Galaxy S 5] AptLogic:
Yeah what Avast picked up was the futex exploit, which is used by towelroot to obtain a root shell on the phone. It's perfectly safe, Windows Defender just mis-flagged it (unfortunately happens more than you think).
[AT&T Samsung Galaxy S 5] samccfl99:
Well, no one has been in here for a while.

I have a question. Can't the OA1 BL replace the OF3 BL in the G900A_OF3_Stock_Rooted_ROM-from-noship.zip? OF3 runs fine on the OA1 BL with the OF3 kernel and it would allow us to get into SafeStrap. There are reasons for this to happen. If not, then maybe [MENTION=4708661]muniz_ri[/MENTION] is still around and I could ask him.

THANKS
[AT&T Samsung Galaxy S 5] AptLogic:
I can do some test flashes and get back to you.
[AT&T Samsung Galaxy S 5] Ronfar:
Is there a way to unroot or pass safety net, either on the 5.0 pre-rooted part, or on any of the custom roms, when i tried a full uninstall of super SU phone got permanently stuck on the att logo.
[AT&T Samsung Galaxy S 5] samccfl99:
Why would you want to unroot? You won't get wifi calling or Android/Samsung Pay with LP anyway, I do not think. You might as well go Stock thru Odin to any LP or MM . I do believe that all custom roms are rooted. How else would you flash them? But I would think there should be a way to unroot without a boot loop. IDK, you will have to wait until the OP or someone else chimes in...;)

---------- Post added at 02:32 AM ---------- Previous post was at 01:33 AM ----------

I was checking out the zip files. I see you used a modified [MENTION=4708661]muniz_ri[/MENTION] OF3 . I do not know a whole lot, but I compared the original updater-script to the no-ship one (what does that mean anyway, no-ship?). I see all those extra package extracts. After we go to OF1 and root, can't we Odin the OA1 BL (still a KK BL) and then use a modified version of the no-ship which does not load the BL? Most of muniz's LP zips did not flash the BL to keep it at OA1.

Just thinking about it. No pressure of course. It would be nice to checkout MM again. I did not have it on long enough to test some stuff the first time. I luckily (as you may know) reverted back before that rooting method was taken away by that company (already forgot them). Now that you have made the procedure to downgrade and root again, it would be nice to get the OA1 BL back, like it should be in 5.0. Still have not tried going back to OF1 and coming forward, but I sure would if you could do this. :)

Also my phone is getting kinda wonky after 3 years and I would like to reflash my rom, but SafeStrap was recommended instead of Flashfire, something about the permissions did not all work right. Maybe it was fixed in later releases of FF. Plus if something ever really happens and you can't boot to use FF, SS is handy indeed. I never had a problem in the 3+ years, but better to be safe then sorry.

I almost snagged a new G935-F on Ebay for $315, but was outbid. I really like my custom status bar icons and it seems the Artistry has gone out of custom roms. I really despise stock.

OK, THANKS
[AT&T Samsung Galaxy S 5] Helgen:
I know you didn't ask me, but I'm going to tell you now, it's not worth it to root back to 5.0/1. All the roms for it lack so many of the features that Marsh has, and even so using xposed and what not, they still don't come close to marsh and you will experience tons of glitches ("something-something has closed", play store dependencies problems etc.) None of the roms I tried were really any good, sometimes they mess up your phone and you have to start again. I used alliance rom before, I got sick of it. Too many problems, I used a few others and they were all equally annoying.

Sure, I have no root now, but I actually don't care. Only thing I wanted was to play YouTube in the background, but they've been patching that **** left and right these days so it doesn't even really matter. At least there's been a few apps to bypass freezing/disabling services on this phone (like BK Disabler) can stop that bloatware somewhat.
[AT&T Samsung Galaxy S 5] taadow1030:
6.01 Marshmallow would be tempting for me if we didn't have all of the At&t pre-installed apps. If we just had a nice, clean ROM with only Samsung Apps, that would be great. However, I believe that all of the various stock ROMs that are available are carrier based. Someone please correct me if I'm wrong.
[AT&T Samsung Galaxy S 5] samccfl99:
I guess you could try it now that it seems there is a permanent way to go back to rooted 5.0 and restore your backup. When I went to MM, I purchased that Package Disabler app for $1.49, but never got a chance to use it because I could not stand all that WHITE and luckily I reverted back to rooted 5.0 before that old method stopped working. My G900A came with KK and I got it in 06/2014, so I been rooted forever, not like the people who got their phone later or took an OTA. I never will understand why Googley went to that crappy white material design. I have seen Stock N on a S7E and I guess they finally got their crap together and allowed a dark theme. They took all the Artistry away from Android devolpment. I guess they think everyone has good eyes. I like my status bar pretty and see-able. The only thing I would want from MM is Wifi calling/SMS, which you cannot get on ATT with LP and also maybe some better battery life, although the custom rom does help with that.

The screenshot is not my wallpaper now, but the status bar is sooo neat. I do not much care about any new things really, but my friend with the G935-T says his battery lasts all day, even with FB running (I don't...battery killer and not necessary anyway...LOL), but it is a bigger battery than we have, unfortunately IT DOES NOT COME OUT... Which probably makes it like a rotten apple iphone. I'd like to see one of those last over 3 years like mine...same battery too. Of course it is very hard to find a phone with a removable battery these days anymore. The S5 was and still is a good phone. Wish I had the money for a G950-F though...:D
[AT&T Samsung Galaxy S 5] samccfl99:
I hated Alliance, but it was the first LP custom rom for our phones. I use TMS5 3.0, but you would have had to follow it from the beginning and apply all the fixes and even with that, the Dev left the phone and never totally cleaned it up. It works pretty well with all the fixes. A few minor problems, but it don't bother me much. But I do understand your point! I need root more for the aesthetics...:D
[AT&T Samsung Galaxy S 5] wooser:
You can play youtube in the background with newpipe or ogyoutube. Download it on apkmirror, or if you want it with the recent youtube UI updates downlaod the mod here: https://xdaforums.com/apps/magisk/module-og-youtube-adaway-magisk-t3606966

I think AptOS with xposed is much better than marshmallow, if you haven't tried that. Since the rom is basically aosp it works with xposed modules that wouldn't work on any of the other touchwiz ROMs. Only downsides are no fingerprint or multiwindow.
[AT&T Samsung Galaxy S 5] Old School Joe:
I use Nova Launcher and LOVE it !! No wasted screen space for me, Can't say enough about it

https://play.google.com/store/apps/details?id=com.teslacoilsw.launcher.prime&hl=en
[AT&T Samsung Galaxy S 5] samccfl99:
I have always used that, but it has nothing to do with all the white backgrounds in Contacts and many places. Nor does it change the text font and color. See attached pics from my modified TMS5 3.0. Love the BIG clear button and the red text. 61 here, bad eyes...LOL.

I think I am going to bite the bullet and get a G950-F (Intl S8), and it will run Nougat, but Googley has killed Dev. Probably can't get those Big status bar icons and other things, but it's time to move on. Had my G900A since 06/2014. Still runs fine with same battery. Was/is a damn good phone!
[AT&T Samsung Galaxy S 5] samccfl99:
OF1, FF and SS Testing Results

So [MENTION=7597286]AptLogic[/MENTION] and others. I did the downgrade to OF1 and it worked fine. Boy, is that Experimental or what??? :laugh::laugh::laugh:. That yellow box was a pain! Flashed the OF3 and then installed FF and restored my backup. I even included the internal when I did my backup and all the files on the Internal were back (you know the OF1 wipes out Internal, as all Odin full roms flashes do that!). Worked fine. I was impressed.

So, FYI, I tried to Odin the OA1 BL after OF1 was up and it failed, but it did not matter. I kept asking for quite a while about NCE Flasher and SafeStrap. The OF3 BL loads the OA1 kernel (which is what NCE Flasher does) fine and it booted right into SS (of course it has been on my phone all this time). Then I just flashed the OC4 Kernel and it rebooted fine, I was just testing it.

Many of you don't care about SS, but it is very handy if your phone bootloops. All you need to do is Odin the OA1 kernel and reboot and off you go and you could restore a SS Backup. If you are not able to boot up, then you can't use FF to restore a backup. Of course you have to install NCE FLASHER and install SS and also it's recovery for this to work. I never have any problems, nor have I bootlooped, but you NEVER KNOW...:D

I needed it to dirty flash my TMS5 3.0. Wonky things are happening after over 3 years...LOL. I have all the fixes to this rom and I am sure things will work better. Apps are there anyway after a dirty flash. Oh, you lose the Wifi keys and not much more. I found out once that if you wipe Delvick, you lose the wifi keys too...who knew???!!!

So again thanks to the few who dug and came up with the OF1 and the OP's instructions.

Have a happy and long Labor Day weekend, ALL!