[Samsung Gear S3] adfree:
New month, new attempt. :D

Task to identify how rootfs.img is protected against modding...

Step 1.

Combination Firmware FTMA BQC2

Tizen 2.3

To have ROOT + special Bootloader sboot.bin + special Kernel dzImage

I can use netOdin. :good:

Step 2.

My victim is... rootfs.img from APJF...

2.1

I am using my Tizen Mobile SM-Z300H for rootfs.img creation... reduced Batch to inject 1 Binary... su:

sdb root on
sdb push .\GearS3root\su /opt/usr/media/Others
sdb shell mount -t ext4 -o loop,rw /opt/usr/media/Others/rootfs.img /opt/usr/media/Others/2
sdb shell cp /opt/usr/media/Others/su /opt/usr/media/Others/2/bin
sdb shell cd /opt/usr/media/Others/2
sdb shell sync
pause
sdb shell cd /
sdb shell umount /opt/usr/media/Others/2

2.2

After I have copied modified rootfs.img to my PC...

I will check last few Bytes... with WinHex...

Hmmmmmmmmmmmmmmmmmmmm... maybe in next attempt I will remove 256 Byte RSA 2048 Signature + 16 Byte Software Revision "Info Block"...

Step 3.

TAR with 7Zip...

Step 4.

Flash with netOdin

Step 5.

Check with RDX Logfile... why this f%&$ing Security Check is alive... :silly:

Result later...

Need now time...

Best Regards

Edit 1.

<ID:0/001> 192.168.49.1
<ID:0/001> Odin engine v(ID:1.0000)..
<ID:0/001> File analysis..
<ID:0/001> SetupConnection..
<ID:0/001> Initialzation..
<ID:0/001> Get PIT for mapping..
<ID:0/001> Get PIT Transmission
<ID:0/001> Firmware update start..
<ID:0/001> SingleDownload.
<ID:0/001> rootfs.img
<ID:0/001> NAND Write Start!!
<ID:0/001> RQT_CLOSE !!
<ID:0/001> RES OK !!
<ID:0/001> Remain Port .... 0
<ID:0/001> Removed!!
<OSM> All threads completed. (succeed 1 / failed 0)

My SM-R760 is now in Kernel Panic/Upload Mode

Will now try to connect via USB cable to RDX...

Edit 2.

Part of RDX Log... v1

0.894] fuelgauge : VCELL 3864mV
[ 0.897] AP RESET: S/W RESET (0x20000000)
[ 0.901] PWRONSRC: PWRON (0x1)
[ 0.904] MAGIC: 0x0
[ 0.907] ESS SIGN: 0xbaba
[ 0.909] INFORM2: 0x12345678
[ 0.912] INFORM3: 0xc8
[ 0.914] REASON: REBOOT (mode: 9)
[ 0.918] s5p_check_reboot_mode: INFORM3 = c8 ... skip
[ 0.922] rustproof mode Disabled
[ 0.926] s5p_check_modem_secure_fail: 0
[ 0.929] s5p_check_upload: MAGIC(0x0), RST_STAT(0x20000000), ESS(0xBABA)
[ 0.936] PM status1, CHG status1/2/3 : 0x1a,0x40,0x80,0x00
[ 0.941] s2mpw01_microusb_get_device: device(0) adc(0x1f)
[ 0.946] s5p_check_upload: debug level is MI! (mask: 0x1)
[ 0.951] 0x494d: WRST enabled
[ 0.955] board_uart_io_share_ctrl: Set to USB
[ 0.959] 0x4f4c: MRST enabled
[ 0.962] start=0x46200000, end=0x463fffff, size=56
[ 0.967] start=0x46400000, end=0x465fffff, size=96
[ 0.971] start=0x46600000, end=0x467fffff, size=136
[ 0.976] start=0x47c00000, end=0x47dfffff, size=176
[ 0.981] start=0x46802000, end=0x46841fff, size=216
[ 0.986] start=0x46844000, end=0x46883fff, size=256
[ 0.990] start=0x46886000, end=0x468861ff, size=296
[ 0.995] start=0x46888200, end=0x468883ff, size=336
[ 1.000] start=0x40000000, end=0x5f1fffff, size=376
[ 1.004] start=0x60000000, end=0x6fffffff, size=416
[ 1.009] RST_STAT = 0x20000000
[ 1.012] INFORM0 = 0x0
[ 1.014] INFORM1 = 0x0
[ 1.016] INFORM2 = 0x12345678
[ 1.019] INFORM3 = 0xc8
[ 1.021] INFORM4 = 0x0
[ 1.023] INFORM5 = 0x3f10
[ 1.026] INFORM7 = 0x0
[ 1.032] read 'ani_upload_1_kernel_panic.jpg'(9907) completed.
[ RST_STAT = 0x20000000 ]
[ RST_STAT = 0x20000000 ]
ASV TBL VER = 5
ASV TBL VER = 5
LOT_ID = N54R2
LOT_ID = N54R2
ASV CPU:5 G3D:5 MIF:5 INT:5 CAM:5 CP:5
ASV CPU:5 G3D:5 MIF:5 INT:5 CAM:5 CP:5
Attempted to kill init! exitcode=0x00007e00

Edit 3.

Added 2 Logs...

only human readable part...

LOG_A.txt is after netodin flash... first Start...

LOG_B.txt is after this way...

Reboot Menu
Download (ODIN Mode)
Recovery

This is normally my way to bypass first "hang" with my rooted LDU rootfs.img...