yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy S 5] l0gandroid:
thanks dude, I'll finally completed the process and already have my phone rooted with Android 5.0.

But I found 2 problems with the GUIDE.

first problem is with the version of SUPER-SUME that you can download from de Playstore. The APP you can download from the market needs to download an upgrade, and then, when you run it, the process stucks and never finish.

I solved the problem downloading another version of SUPER-SUME from internet.

The second problem was with the version of OF3.zip that I download.

In the second post you refer to G900A_UCU4BOF3_ATT4BOF3.zip, as a rom to make the roll back

but in a third post you refered to G900A_OF3_Stock_Rooted_ROM.zip, as a rom to Going back to good ol' 5.0.

I think it's important to remark which is the rom that it's necessary to make the process right.

Thanks a lot for your help.

Now, I got a finally question. Do you think I can upgrade to OI5 5.1.1 and get root?
[AT&T Samsung Galaxy S 5] AptLogic:
Thanks for the input! I'll make sure to make the necessary changes in the OP.

As for Supersume, I've got an APK that works fine, I'll link it in the OP as soon as I get home.
[AT&T Samsung Galaxy S 5] AptLogic:
I'll see about having a look at the desktop app the next time I brick my device (and as a ROM tester that won't take long lmao).
[AT&T Samsung Galaxy S 5] mrredcon:
Thanks for the info, not at home at the moment, but I'll definitely look into the USB logger app.
[AT&T Samsung Galaxy S 5] TheMadScientist:
i just unchecked the box

---------- Post added at 03:13 PM ---------- Previous post was at 03:12 PM ----------

i dont think u can link it as its a paid app

im for it but xda rules

---------- Post added at 03:15 PM ---------- Previous post was at 03:13 PM ----------

i try to pass this one on to people too

long time user of

chelpus lucky patcher

not really allowed to talk about its functions but now u have root check it out

dont work on sume but a lot of games i know a few apps it works great on like flashify

https://lucky-patcher.netbew.com/
[AT&T Samsung Galaxy S 5] AptLogic:
I've seen it linked once or twice in other threads so we'll see what happens.

If a mod has a problem with it, they can tell me and I'll take it down, problem solved.

EDIT: I already got lucky patcher, I don't use it often but I do if I have to.
[AT&T Samsung Galaxy S 5] TheMadScientist:
wish i woulda known ive had a good version of it for a long time

apkpure and apk4fun are actually killer site for getting apks
[AT&T Samsung Galaxy S 5] DejaVuAgain:
And not to forget Mobilism ...

---------- Post added at 10:53 PM ---------- Previous post was at 10:33 PM ----------

Here is a bit of the decompiled Kingo apk ...

package com.kingo.sdk.entity;

public class CommonConstant {
public static final String BUSY_BOX = "busybox";
public static final String KINGO_USER = "KingoUser.apk";
public static final String ROOT_FILE_NAME = "root.zip";
public static final String ROOT_PROGRAM_NAME = "script.zip";
}

The app definitely calls home for the rooting stuff (as well as for the the apps it installs).

Look for root.zip & script.zip in the the USB traffic ...

Also, I found a partial URL in the code to where it downloads from ... there are some parameters that are added to the end of the URL at run-time ... those specify what root code should be downloaded.

The root code is definitely not one-size-fits-all, but should be device & Android version specific.

I think if we can capture those couple of files, that we will be able to build an offline root tool.

I'm going to explore "modifying" the app to reduce the nasty side of it's behavior.
[AT&T Samsung Galaxy S 5] AptLogic:
[MENTION=7958871]DejaVuAgain[/MENTION] I got the github repo up and running, I'm uploading the files I've got so far right now.

https://github.com/a4asystems/X-ROM-G900A

I've got a problem with it currently where the OS won't boot after flashing, it just sticks at the Samsung logo. (I should add this is a newer rebased version of X).

I'm trying to rebase X to DevBase 3.6 (Android 5.0) but this problem is stopping me from releasing.

I suspect a permissions issue so I'll take a look into that but I'm not sure. [MENTION=7533813]NavSad[/MENTION] if you could take a look too that would be great, syncing the repo now so the files should be available within the next half hour.

UPDATE: the files have finally been synced to GitHub and are now available for viewing/forking
[AT&T Samsung Galaxy S 5] Triskite:
In case anyone else is having trouble:

I just successfully got pre-rooted OF3 (and alliance after) onto a PH4 phone by following the first 3 posts with one tweak - I tried 5+ different versions of kingroot and two different versions of kingoroot and the only combination that worked was the Android 4.1.2 version of kingoroot (download indirectly available at the bottom of the homepage) and the 4.8.0 version of Kingroot (available here on xda in kingroot download page).

SuperSUme 6.0 I found with a google search (the apk4fun mirror worked for me) and also here on xda.

Hope this helps someone. I reinstalled kingroot AFTER rooting (and verifying root) with kingoroot.
[AT&T Samsung Galaxy S 5] NavSad:
There's no su binary in /system/xbin.
[AT&T Samsung Galaxy S 5] AptLogic:
The su binary is added after the system is flashed by invoking the su_busybox script in the tmp directory
[AT&T Samsung Galaxy S 5] mrredcon:
Oh great, I tried to download the dang KingoRoot program, but the server's getting me a 500 error .-. Time to find a mirror
[AT&T Samsung Galaxy S 5] oriax123:
What if we patched kingoroot to download supersu instead of kinguser making the root method smaller. That's what I was looking at
[AT&T Samsung Galaxy S 5] AptLogic:
That's the easy part. The hard part is doing that and isolating the code Kingo uses to download the exploit it uses to root.
[AT&T Samsung Galaxy S 5] DejaVuAgain:
It's not really a matter of patching the app per se because the actual exploit code & installation script are downloaded at run-time after the app determines your hardware & software configuration.

Patching the app may be able to eliminate the "addons" that Kingo so kindly provides (not!).

Ideally, we'll be able to capture the actual exploit code & then have our way with it ...
[AT&T Samsung Galaxy S 5] oriax123:
I made a G900A OI5 kernel flashable zip via Flashfire so you can add when flashing a rom and it'll flash right after before boot so no need for odin. Uploaded in case anyone wants it.

https://www.dropbox.com/s/mvervrjdv6p1ow9/G900A_OI5_Kernel.zip?dl=1
[AT&T Samsung Galaxy S 5] lordmorphous:
ok 870A guys...i've tried this on PB1 and still no dice....I'm out until someone else finds a way, or next weekend....whichever comes first!
[AT&T Samsung Galaxy S 5] AptLogic:
Okay I think the problem I'm having with the X ROM is a problem with the source .img file I used. It should be fine but apparently not... I'm looking into alternate stock-based images to use.

Update: Based on the build number for the ROM I used as a base I think I was accidentally using an Android 5.1.1 image instead of 5.0
[AT&T Samsung Galaxy S 5] wforider:
Anyone running Kali linux on our AT&T S5
[AT&T Samsung Galaxy S 5] AptLogic:
I don't think that's possible because Kali Nethunter is not compatible with any Kernels we have at our disposal.
[AT&T Samsung Galaxy S 5] mrredcon:
Anyone who wants to help can download Charles here:https://www.charlesproxy.com/download/

It's a reverse proxy server that you can install to monitor all the sites Kingo wants to hit, just change the proxy settings on your Android (WiFi -> Long press on network -> Advanced network settings -> then Proxy), and type in the IP Address of your computer running Charles. I didn't find toooo much, seems like it wants to hit dl.kingoapp.com/mobile-root/dependent/ and grab a couple of files, something called KingoUser.apk, busybox, and this cool little zip called rootkit_baka_a.zip, which has a bunch of binaries in it. Gimme a little bit to find out what commands they're issuing to our phones
[AT&T Samsung Galaxy S 5] TheMadScientist:
So every ones knows DO NOT TRY TO SET KERNEL TO PERMISSIVE Ends in bootloop.....

I can't get viper4 to work and normally i set to permissive and alls good..

I think Knox is blocking it.

Since I don't have a warranty. What's the Easiest way to remove Knox completely?

Ive seen it done on other samsungs is it even possible to on here??
[AT&T Samsung Galaxy S 5] DejaVuAgain:
That's really interesting ...

As I pointed out a few posts ago (#852), we're looking for root.zip & script.zip which are defined to right next to busybox & KingoUser.apk.

Perhaps they're inside rootkit_baka_a.zip? (It actually sounds a little more sinister).

Standing by to hear what you find ...

---------- Post added at 03:25 AM ---------- Previous post was at 03:22 AM ----------

You can disable Knox using EZ Disabler, even if you're not rooted.

If you have root, just delete or freeze anything that says "Knox".

I've been doing that for a long time with no negative repercussions...
[AT&T Samsung Galaxy S 5] AptLogic:
So I fixed the problem with hanging at the Samsung Galaxy S5 boot screen, seems to have been a kernel issue, solved by downgrading the DevBase I was using.

These changes have been pushed to GitHub, along with a new install script.

Now the device gets to the startup animation, but hangs there for more than 10 minutes, no idea what the problem is now but it's not a good one.

Can someone go in and take a look at the files and see whats up? https://github.com/a4asystems/X-ROM-G900A
[AT&T Samsung Galaxy S 5] mrredcon:
It's up now!

Alright fellas, I'm capturing every command that Kingo is sending to my phone, stay tuned...

Okie dokie, I saved it as a .csv that you can open in excel if you have it...get it here: Edit 2: https://1drv.ms/u/s!Ano0y8QC9NRojUa_AvcBTvmYHJO3

Unfortunately, this isn't the whole thing for two reasons:

1) my Active is probably not supported

and 2) Phone hanged at 70ish percent. After the last command, it kept issuing "fastboot devices"

Do what you will with this, I'm going to upload the binaries that it used in the AppData folder, but I do not have the qt binary it used it the Temp folder, maybe I'll try and grab it later...
[AT&T Samsung Galaxy S 5] oriax123:
Here are 2 more G900A kernel flashable zips for Flashfire I did just now for anyone who wants to add to their collection.

OC4 : https://www.dropbox.com/s/4xjszzqu5137aoa/G900A_OC4_Kernel.zip?dl=1

OF3 : https://www.dropbox.com/s/mbk7ihcdmsuvpsi/G900A_OF3_Kernel.zip?dl=1

woot
[AT&T Samsung Galaxy S 5] sixxkilur:
Thanks; what would we use this for?
[AT&T Samsung Galaxy S 5] mrredcon:
And here is the AppData binaries it used from the .csv https://1drv.ms/u/s!Ano0y8QC9NRojUXcTj9qO94fSMOq

Check out the original post #870 for more info
[AT&T Samsung Galaxy S 5] oriax123:
For example if you flash a rom using Flashfire if ots not 100% supported then you have to Odin kernel to get it to boot. With this in Flashfire you put the rom you want to flash then add another zip to flash (kernel) and it'll will flash the kernel right after the rom so don't need to use Odin.

Use at your own risk. I tested each and flash fine but each rom is different and need to use the correct kernel. (At least I think lol)
[AT&T Samsung Galaxy S 5] DejaVuAgain:
So Conner, to me, it looks like a loop enumerating your system variables ... no actual "traffic".

By Conner, I mean your VM or course ;) ...
[AT&T Samsung Galaxy S 5] mrredcon:
Check the new link, I uploaded the wrong file, sorry!!!
[AT&T Samsung Galaxy S 5] AptLogic:
Anyone in the mood to use IDA and HexRays for ARM to decompile kingo_6add4623 aka rootkit_baka?
[AT&T Samsung Galaxy S 5] DejaVuAgain:
Sure, as always, I've got IDA ready to go in SandBoxie ...
[AT&T Samsung Galaxy S 5] mrredcon:
I'm not sure if this is related, but earlier I said the KingoRoot Android app tries to hit http://dl.kingoapp.com/mobile-root/dependent/rootkit_baka_a.zip, which you can actually download it from...again, don't know if it'll help you, but its full of binaries that it references in the ADB commands like mkdevsh and stuff

edit: oh wait I understand you guys now, nevermind, just trying to help
[AT&T Samsung Galaxy S 5] AptLogic:
taking a look at it now, will update.

UPDATE: found a nice interesting classes.dex file in there... and two decompilations later we got classes.jar, which contains....

(cue fanfare)

C code and a function entitled "fast_root"

But, I don't know C (rip), so its up to you guys to make something out of this:

https://www.androidfilehost.com/?fid=529152257862699276
[AT&T Samsung Galaxy S 5] DejaVuAgain:
OK, we may have something here ...

"mkdevsh" is actually a shell script ... read "mkdev.sh"

With only a 30 second skim, the script appears to be the entity that installs the Kingo SU & all the other "awkward" stuff after root ... (actually, root may be in there as well, I don't know yet).

I may not be able to get to it 'til tomorrow 'cause my bride needs some attention too ...
[AT&T Samsung Galaxy S 5] AptLogic:
Congratulations on your pending marriage :3

Refer to my last post, I found what seems to be a root script in classes.dex, which I converted to .jar form, viewable with jd-gui
[AT&T Samsung Galaxy S 5] mrredcon:
Something completely unrelated that I hope you guys can help me with, how can I kill the AT&T OTA service? I'm afraid to go on WiFi because of that SOB. Don't have root
[AT&T Samsung Galaxy S 5] AptLogic:
Adb in, and run "adb shell pm hide com.ws.dm"
[AT&T Samsung Galaxy S 5] DejaVuAgain:
Not pending .. shacked up for 10, "official" for 2.5 ... still my "bride" ..

I didn't look past the script folder (in the first 30 seconds).

I'll look more deeply tomorrow ... but it sure looks interesting.

Ya, I use JD-gui as well, but I've discovered an even easier resource for decompiling apk, jar & dex files ... here

I'll check it out, but let me know what you find ... (so we don't needlessly cover the same ground) ...
[AT&T Samsung Galaxy S 5] AptLogic:
Okay I'll take a look at it tomorrow. I'm watching the press conference on the Note 7 failure.
[AT&T Samsung Galaxy S 5] DejaVuAgain:
Just had another little look (can't help myself) ...

I think we've almost hit the jackpot.

The various scripts certainly will tell us what's going on (after a little parsing & study).

The actual root seems to happen here:

package com.kingo.root.lib;

import android.content.Context;
import com.kingo.root.lib.util.FastRoot;

public class FastRootImpl {
private FastRoot fastRoot;

public FastRootImpl(Context context) {
this.fastRoot = FastRoot.newInstance(context);
}

public boolean kongquexiang() {
return this.fastRoot.doRoot();
}

public boolean zhulong() {
return this.fastRoot.doZhuLong();
}

public boolean rootkit_hannibal() {
return this.fastRoot.doHannibal();
}

public boolean rootkit_jiuyin() {
return this.fastRoot.doJiuYin();
}

public boolean qianxun() {
return this.fastRoot.doQianXun();
}

public boolean yangyang() {
return this.fastRoot.doYangYang();
}

public boolean bawangqiang() {
return this.fastRoot.doBaWangQiang();
}

public boolean duoqinghuan() {
return this.fastRoot.doBaWangQiang();
}

public boolean rootkit_pandora() {
return this.fastRoot.doPandora();
}

public boolean rootkit_io() {
return this.fastRoot.doIO();
}

public boolean rootkit_qiqi() {
return this.fastRoot.doQiQi();
}

public boolean rootkit_baihe() {
return this.fastRoot.doBaihe();
}

public boolean rootkit_baka_a() {
return this.fastRoot.doBaihe();
}

public boolean rootkit_baka_b() {
return this.fastRoot.doBaihe();
}

public boolean copyRoot() {
return this.fastRoot.copyRoot();
}

public boolean doRemoveRoot() {
return false;
}
}

I haven't seen any signs of those "orientally" named functions ... where are they imported from?

(OK, we know from where, but how is the URL constructed? ... oh wait, there are strings that start with http:// service.kingo .......)

I've seen some traces of humour (oh ya, humor for the 'mercans) in the code, so I'll be interested to find out what the allusions are.

There are also a number of oriental character strings (Chinese?) just begging for Google Translate.

Interesting stuff ...
[AT&T Samsung Galaxy S 5] AptLogic:
Yeah ill take an in depth look tomorrow if I remember to start up my file server before I leave home xD
[AT&T Samsung Galaxy S 5] DejaVuAgain:
Just thinkin' about the sequence of rooting function calls ...

Contrary to what was indicated by the enumeration of hardware & software, the actual rooting seems to be a (brute force) sequential call to everything they have in their toolbox ... (certainly makes sense from a server-side point of view, ie do nothing (other than serving up the stuff)).

Since I don't know Java (yet), I don't quite understand the return structure ... where is the evaluation of the return happening?

Too many mysteries for this evening ...
[AT&T Samsung Galaxy S 5] sixxkilur:
found in Kingo Root AppData Binaries\uts\utstemp
[AT&T Samsung Galaxy S 5] DejaVuAgain:
OK, just a guess ... are you talkin' the PC version, & AppData\Binaries\uts\utstemp?

In any case, I'd sure like to see those files ...

---------- Post added at 05:55 AM ---------- Previous post was at 05:44 AM ----------

It looks like Kingo (& I suspect Kingroot as well) don't actually have their own SU ... it looks like they're using ChainFire's (based on the SU & daemon names ... I'll do a binary compare later).

I think they're controlling the game using SElinux, file contexts,ownership & permissions ... kinda makes sense ... why re-invent the wheel?

It may also simplify the path to moving from Kingo SU to SuperSU ...
[AT&T Samsung Galaxy S 5] sixxkilur:
The one from https://xdaforums.com/showpost.php?p=70793288&postcount=873
[AT&T Samsung Galaxy S 5] PopTartKing:
I know this might sound stupid, but have any of you guys considered running another version of Android on top of the stock firmware, kind of like a virtual machine? I guess it would be like virtually running a kernel, similar to the Note 3 post that someone mentioned a little while back.
[AT&T Samsung Galaxy S 5] Cruci-:
Then that means I can install a ROM/Port that requires a MM bootloader via flashfire? Can someone confirm this for me please. :confused::confused::confused:

If I'll lose root, I can still live with that, as long as I'm running the MM ROM that I wanted :D

Edit: Is the BL in the ODIN represents BootLoader? It made me curious and tried changing that into the MM's BL instead of the COI5's
[AT&T Samsung Galaxy S 5] AptLogic:
Not necessarily. See, we've been able to flash MM ROMs this entire time. The problem is they can't be PREROOTED due to selinux changes in the kernel
[AT&T Samsung Galaxy S 5] Cruci-:
Oh, glad to hear that, sir!

I've flashed a ported MM Rom around here somewhere and it says something about AT&T saying that the kernel is changed bla bla bla and I was worried that I have bricked my device so, yeah :D And in that ROM it says that a MM bootloader is needed but I didn't give sh** so, a lesson was given to me.

Also tried rooting in MM PH4 by trying those steps in the 1st page and it got stuck @ 90% (kingoroot)

One more thing sir, does this https://xdaforums.com/galaxy-s5/development/rom-noble-rom-t3403867 work?

I would also like to say Good Job :good: for giving an effort to prolong our AT&T S5. If only I know what I'm doing then I will work 24/7 just to unlock the bootloader.
[AT&T Samsung Galaxy S 5] AptLogic:
That ROM should work but I don't know for sure since I'm currently doing testing for X.
[AT&T Samsung Galaxy S 5] AptLogic:
Found this nice little piece of code in "FastRoot.class" in the decompiled .DEX file:

public boolean doBaka()
{
String str2 = "cd " + this.fileDir + "/script;chmod 755 kingo5;chmod 755 mkdevsh;";
String str1;
if (checkHigherFive()) {
str1 = "./kingo5;sh mkdevsh";
}
for (;;)
{
str1 = str2 + str1;
try
{
execCmd(new String[] { "sh", "-c", str1 }, 60L);
if (ShellUtils.checkRoot(this.mContext))
{
return true;
str1 = "./kingo;sh mkdevsh";
}
}
catch (TimeoutException localTimeoutException)
{
for (;;)
{
localTimeoutException.printStackTrace();
}
}
catch (InterruptedException localInterruptedException)
{
for (;;)
{
localInterruptedException.printStackTrace();
}
}
catch (IOException localIOException)
{
for (;;)
{
localIOException.printStackTrace();
}
Log.d("FAST_ROOT", "normal failed");
}
}
return false;
}

I think this might be the exploit, EDIT: the exploit actually seems to be located in script/kingo5. the way the program seems to work is that it runs the exploit to get a basic root, and then uses that to apply their version of SuperSU using (what seems at first glance to be) a regular su binary but with different SELinux permissions. This would explain why KingRoot is able to apply their root over it so easily.
[AT&T Samsung Galaxy S 5] DejaVuAgain:
I don't think the doBaka() function is THE exploit, but rather AN exploit ... there's a whole bunch of similar functions before & after doBaka() ... as I said in a previous post, I think Kingo brute forces its way through its set of exploit functions until a function return is "true".

I'm just working my way through the syntax to understand exactly what's going on, but my understanding so far is ...

each of the exploit functions builds a shell command string that the then java executes & traps the exception codes.

So far I don't see any binary exploit code ... just simple permission based vulnerabilities.

Since the root.jar seems to be the exploit code, I'm going to try to build an apk to run it "naked".

I just need to collect the dependencies (which I hope aren't integrated with all the "nasty stuff").

(I'm sure glad that Kingo didn't obfuscate their code!)

This should get interesting ...
[AT&T Samsung Galaxy S 5] AptLogic:
You should give decompiling Kingo5 a try... I'd like to see whats in there but I don't have IDA Pro... rip
[AT&T Samsung Galaxy S 5] DejaVuAgain:
Another interesting function ...

This function "snuffs" any existing SU ...

private String getRemoveSuFileStr() {
int i = 0;
String[] suFiles = new String[]{"/sbin/su", "/vendor/bin/su", "/system/bin/su", "/system/sbin/su", "/system/xbin/su", "/system/xbin/daemonsu", "/system/bin/.ext/.su", "/system/bin/.ext/", "/system/usr/.suv", "/system/bin/.suv", "/system/bin/.usr/.ku", "/system/xbin/ku.sud", "/system/app/Superuser.apk", "/system/xbin/mksh", "/system/xbin/dexdump", "/system/etc/install-recovery_bak.sh", "/system/etc/install-recovery.sh", "/system/etc/install_recovery.sh", "/system/etc/.has_su_daemon", "/system/etc/.installed_su_daemon"};
StringBuilder sb = new StringBuilder();
int length = suFiles.length;
while (i < length) {
String su = suFiles[i];
sb.append(this.fileDir);
sb.append("/busybox chattr -i -a ");
sb.append(su);
sb.append(";");
sb.append("rm ");
sb.append(su);
sb.append(";");
sb.append(this.fileDir);
sb.append("/busybox rm ");
sb.append(su);
sb.append(";");
i++;
}
return sb.toString();

It looks like it builds an string array of known SUs & then loops through the array removing the various components of any existing SU installation.

Just disabling this function would quite likely "neuter" Kingo ...

UPDATE: this function just returns the snuff string ... I'll check out where it's called from ...

Update2: The nasty work is done here ...

private boolean removeSuperUser(boolean isCopy) {
boolean isSuccess = false;
String[] su_manager_packages = new String[]{"com.noshufou.android.su", "com.noshufou.android.su.elite", "eu.chainfire.supersu.pro", "com.koushikdutta.superuser", "com.qihoo.root", "com.qihoo.permmgr", "com.kingroot.master", "com.kingroot.kinguser", "com.kingroot.RushRoot", "com.baidu.easyroot", "com.lbe.security.shuame", "com.lbe.security.miui", "com.miui.uac", "com.mgyun.shua.su", "com.supercleaner", "eu.chainfire.supersu", "co.lvdou.superuser"};

There appears to be some stream IO at the beginning so perhaps there's some run-time downloading going on ... still lots of mysteries ...
[AT&T Samsung Galaxy S 5] AptLogic:
You'd need to make sure the permissions are correct as well as replace the Superuser APK and some of the binaries (just to be safe).