yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S8+ Guides, News, & Discussion] t-shock:
Excited to see that someone is working (sort of) on exploiting the bootloader and thus avoiding the knox counter

Please let us know with your future progress :good:
[Samsung Galaxy S8+ Guides, News, & Discussion] militiaOfDeath:
Any progress on this? Trying to achieve UART myself, but so far nothing.
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
I actually made one and then lost it when formatting my laptop. I shall probably do it again in the next few days, possibly today. Heads up though, it is not a solution in itself. The resistor magic happens within the Anyway Jig and I think that only the S103 is compatible with USB C. In any case, watch this space. If you want to share any findings, please PM me!
[Samsung Galaxy S8+ Guides, News, & Discussion] TimelessPWN:
How were you going about reverse engineering the bootloader
[Samsung Galaxy S8+ Guides, News, & Discussion] vermiciouskanid666:
Doesn't usb-c spec call for a 56k resistor in the cable? I remember there being a problem with incorrectly manufactured cable having 10k resistors.
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
I am using IDA Pro. I wish I also had hex-rays, but that is a little out of my budget.
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
I think so, but I am not 100% clear on the USB C spec. I can confirm that there are no resistors at all inside the cable though.
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
The pinout has now been uploaded. Happy hunting.

By the way, if anyone has an Anyway box and fancies sending it to me, I would be deeply grateful. Progress is getting slowed by how expensive it is to get hold of all of these secret Samsung parts.
[Samsung Galaxy S8+ Guides, News, & Discussion] Diablosss:
someone succed to make uart cable ?
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
Good news everyone. I got my hands on an S103 Jig and worked out how to use it. I now have UART :D Time to do some reverse engineering and see how this box works.
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
Oh man that's great! Please keep us updated on what you learn

If only you had a snapdragon device and could help with a unlock ?
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
Duplicate post
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
I am currently working on re-doing my blog so that I have a nice place to share my findings.

As for the Snapdragon devices, there are probably some significant changes to the architecture, but I would be happy to give it a go if someone would send one my way. Alas, I don't see this happening any time soon, so you are out of luck for now, I'm afraid :(
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
A write-up is perfect. If you can lay out what you know and learn I can simply duplicate it :)
[Samsung Galaxy S8+ Guides, News, & Discussion] happytomato:
I'm not so sure. Perhaps you might get UART, but I imagine that there is a lot of reverse engineering required to exploit the bootloader in a way to unlock it?
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
I'm comfortable taking a look at that part provided I don't have to figure out the rest.
[Samsung Galaxy S8+ Guides, News, & Discussion] Drdra3:
[MENTION=3812611]elliwigy[/MENTION]
[Samsung Galaxy S8+ Guides, News, & Discussion] gipsy.phone:
Hi,

How did you get that S103 Jig? Where can I get mine too? :o:o

Thanks!
[Samsung Galaxy S8+ Guides, News, & Discussion] jrdingus:
I have sourced a supplier for S103 jigs, as well as USB-C service cables. $250/jig, $75/cable. Think there would be some interest here?
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
Are you sure the s103 works on the g950u? If yes I'm 100% down.
[Samsung Galaxy S8+ Guides, News, & Discussion] vshgsm:
S103

Contact me on Skype : vshgsm@gmail.com

I have some nice surprise for you :)
[Samsung Galaxy S8+ Guides, News, & Discussion] billa:
Looks like the resistor(s) are actually inside the AnyWay box, instead of the usb-c plug.

As you can see in the pinout diagram, line CC is connected to the DB25 header which in turn connected to the box.

So, if anyone has the AnyWay box, the usb-c test cable, and an ohm meter they can simply measure the resistance between ground and pin 23 of the DB25 header. This way we could replicate a test cable without the expensive test jig.

I have played around with the "standard" test resistor values (300k, 523k, 619k etc) between line CC and Gnd, but wasn't able to get any results, not even download mode using a 300k resistor which works on all micro-usb phones. Either usb-c is using different values or there's something else we're missing here.

However, an interesting observation I've made, is that when flashed with combination firmware, the phone accepts most of these low level uart/modem test commands through the usb-c modem port (not the usb-serial port!) via a standard terminal (sometimes they need to be sent a couple of time for it to take, and also dialed *#0*# for test mode):

AT+DEVROOTK=1,0

AT+GMM (Model number)

AT+HWINDICK (CPID S7 and newer)

AT+MSLSECUR=1,0

AT+PRECONFG=1,0

AT+SW=1,0

AT+VERSNAME=1,0

AT+AIRPLANEVALUE

AT+BATGETLEVEL?

AT+CIMI

AT+DEVCONINFO (Long info)

AT+FACTORST (Warning: Forces a factory reset!)

AT+FUS? (DL mode)

AT+GSN - IMEI

AT+IMEINUM

AT+SERIALNO

AT+SIZECHECK (Storage info)

AT+SIZECHECK=1,0 (Storage info)

AT+SVCIFPGM=1,1 (Short Info)

AT+SWDLMODE

AT+SWVER=1,0

AT+SWVERSION=1,0

AT+SYSSCOPE=1,0

AT+WPROTECT=1,0

Read commands:

AT+<command> - read

AT+<command>? - read

AT+<command>=1,0 - read

For example:

AT+PRECONFG=1,0 - reads CSC config

Write commands:

AT+<command>=2,<info> - write

For example:

AT+PRECONFG=2,XAS - writes CSC config

Hope someone steps up to the plate, and gives us the correct resistor value between CC and GND on usb-c :)

Thanks in advance.
[Samsung Galaxy S8+ Guides, News, & Discussion] vermiciouskanid666:
Haven't heard anything in a while. Still working on this?
[Samsung Galaxy S8+ Guides, News, & Discussion] reversethor:
any update/news? [MENTION=301082]happytomato[/MENTION] [MENTION=8796510]vshgsm[/MENTION]
[Samsung Galaxy S8+ Guides, News, & Discussion] Diablosss:
Im interested. Want buy s103
[Samsung Galaxy S8+ Guides, News, & Discussion] Quickvic30:
Ordered the EFT dongle UART cable today, I already have thier dongle. We'll see what happens when it arrives.
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
These look an awful lot like the commands that go to the modem via RIL from IOTHIDDENMENU when you look at the Decompiled source code. This is VERY interesting to me, as there are some things that the app seems to block that could potentially be very promising indeed.

Thank you for sharing! This is the best post on high tech investigation into the s8 I've seen on xda yet.
[Samsung Galaxy S8+ Guides, News, & Discussion] billa:
No problem... I've noticed that some commands work on both uart and modem ports, while others only work on one of the other.

You're right, the ones blocked on RIL, do seem to work on uart.

Problem is that it's harder to activate uart especially on the newer generation phones like the S8 and above.

I've done all my testing on the S7 (real uart) and S8 (fake uart - on the modem port flashed with combination firmware seems to take uart AT commands ; ).
[Samsung Galaxy S8+ Guides, News, & Discussion] TheMadScientist:
Hmmmmmmm..

Same thing related uses to bypass frp. Ap+creg1234 or something like that. Does that mean related program could help here to
[Samsung Galaxy S8+ Guides, News, & Discussion] thanhcong_to:
hello, i have do on this, 80% done!

watching this video:
[Samsung Galaxy S8+ Guides, News, & Discussion] halo87:
Hi, does this mean we can have a rooted note 8 or s9 plus without tripping knox?
[Samsung Galaxy S8+ Guides, News, & Discussion] firefly2004:
Will this enable downgrading of the bootloader?
[Samsung Galaxy S8+ Guides, News, & Discussion] TheMadScientist:
Probably not as the qfuses are still present as well as antirollback
[Samsung Galaxy S8+ Guides, News, & Discussion] porten:
Do we got any process with the uart cable. I try myself with the G955F and A320FL. Tried to find the right resistor for the A3, but unfortunately there are no informations in the kernel source like with the one for the S8.

Bought myself a breakout board for usb-c and connected the CC pin with an 301k resistor but that didn't helped me so far.

I just saw that there are new uart cables for some flasher boxes available. If somebody gots one of them, it would be great if you could measure up the resistor.
[Samsung Galaxy S8+ Guides, News, & Discussion] handy-freak:
I got the box and the cables

Hi,

the resistor may be in the s103 (i'll check monday when i'm back in the office).

But depending the desired use of the S103 you have to adjust some hardware switches on the box.

To use it with usb-c: switch 7 + 8 to upwards position and the little "turn switc" h to 5.

If you supply the phone with extenal power, you have to switch the black switch to on.

For more information se the pspec / product specification document (=part of the service manual).

BR
[Samsung Galaxy S8+ Guides, News, & Discussion] TheMadScientist:
Lol whats the word
[Samsung Galaxy S8+ Guides, News, & Discussion] porten:
That would be great! :) I just need the cable for putting the devices directly to the download mode without the warning information. UART mode would be a nice additional feature for me. Correct me if i am wrong but i think it must be possible to build a cable like that without the box. The needed resistor values are in the kernel source and are the same as for the S7. I ordered a new type-c breakout board which will arrive tomorrow. I update as soon as possible.
[Samsung Galaxy S8+ Guides, News, & Discussion] TheMadScientist:
I tried making 2 usb jigs with 3 100 k and neither kicked to edl so im wondering if the resistance is changed maybe
[Samsung Galaxy S8+ Guides, News, & Discussion] gerryl432:
any updates with the type-c breakout board?
[Samsung Galaxy S8+ Guides, News, & Discussion] nowugo&crackit:
I think there is a chance that the resistor should connect the CC pin to Vcc instead of GND. However, in that case I would expect the resistance to be of a different value from 300 k/ 615 k.
[Samsung Galaxy S8+ Guides, News, & Discussion] porten:
I ordered some breakout boards and two type-c uart cables from AliExpress. The cables are for the z3x box and the eft dongle. After trying them out I couldn't get any boot messages over the typically used baud rates. So I decided to pinout them and find the needed resistors to build my own one. I could figure out that they were both build completely different. Unfortunately both type-c cables of z3x and eft don't use a resistor between ground and cc. The eft cable uses a typical 56k resistor for pull up between vcc and a5, which is used by normal type-c cables aswell.

The z3x cable has an rj45 ending which can be pass through to usb. Actually the pinout from this cables is different to the eft one. Since the eft has a serial to USB adapter (PL2303), which by the way is a clone, the z3x cable has no one. The adapter here is in the z3x box which uses an unknown baud rate too. After pinning out the z3x cable, I found out that there are resistors between each pins but not between ground and cc. There are just some 150k resistors between vcc (a9,b4,b9) but couldn't figure out why. The surprising part was that there were a 150k resistor to cc pin on the b-side (b5). So far I think that the real magic happens within the box or after flashing an custom binary/boot on the phone, which activates the uart.

like nowugo&crackit said, i think that the resistor is between vcc and cc. so far i don't got any progress with the cable :(
[Samsung Galaxy S8+ Guides, News, & Discussion] bioslax:
anyway s101 works with samsung s8? I have type-c test cable
[Samsung Galaxy S8+ Guides, News, & Discussion] porten:
I dont know but you can try it. we dont got the anyway box, but it would help if you could try out the cable and determine any resistors between the wiring.
[Samsung Galaxy S8+ Guides, News, & Discussion] Vaughnn:
So i bought a ftdi uart FT232RL board, a 620k ohm 1% resistor, and some diy usb c 5 pin male, since usb c doesnt have ID pin anymore we need to short CC and GND with the resistor right?
[Samsung Galaxy S8+ Guides, News, & Discussion] Vaughnn:
And can someone help me identifying this pins as the seller doesnt even know what the pins are
[Samsung Galaxy S8+ Guides, News, & Discussion] gipsy.phone:
So, Happy news!

I have my S103 and my USB type C cable:laugh::laugh::laugh:

Now the bad news, I have no idea what to do next... :crying::crying::crying:

Anyone who can point me to a working software to use the Samsung Anyway S103? Please!

How do I use this box?

Thank you.
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
Where did you get a s103?
[Samsung Galaxy S8+ Guides, News, & Discussion] partcyborg:
Unfortunately this is pretty standard affair with the box manufacturers. They don't like people reverse engineering their techniques so they hide away as much as they can. Sorry you wasted some coin but it sounds like a fun project regardless ?

I'm thinking about just saying screw it and getting an easy-jtag unit. It should be able to do all this stuff
[Samsung Galaxy S8+ Guides, News, & Discussion] thanhcong_to:
somebody buy S103 box then they can not use it. cause they need an authorized account by Samsung for open UART port on S103. :mad::mad:
[Samsung Galaxy S8+ Guides, News, & Discussion] Jovan Riparazioni:
I've got an Octoplus Box. I've tried connecting S8 G950F and Note 8 N950N (both Exynos) to UART with normal micro USB adapter with a 525k resistor and a micro to USB C adapter at baud rate 115200. Octoplus Box has a FTDI USB2Serial adapter. I manage to get a really short output, but I cannot reach the console. I opened sboot.mbn of Note 8 with HeX editor and I've found that part of the code has a list of UART commands that I used to get in sboot console of S7 and S7 Edge (both global F models). I just can't figure out how to get some input. I managed to get output even from Galaxy Tab S2 (T819), but gives me no input option. I borrowed from a colleague an EFT box UART C cable which has a PL2303 serial2USB adapter, but I don't get even output when I try to connect N950N with a combination of keys. The phone behaves different when the keys are pressed. I think the problem is that this cable has a voltage and unlike box cables can be used to charge the phone. If anyone has any suggestions, that would be great.
[Samsung Galaxy S8+ Guides, News, & Discussion] frostydawn:
Still anyone hasn't figured out the way?
[Samsung Galaxy S8+ Guides, News, & Discussion] Zfence:
So nothing yet
[Samsung Galaxy S8+ Guides, News, & Discussion] TheMadScientist:
No
[Samsung Galaxy S8+ Guides, News, & Discussion] Zfence:
Oh well I guess I'll do my own testing now.
[Samsung Galaxy S8+ Guides, News, & Discussion] 0sm1um:
a VERY tricky DANGEROUS and limited way to get uart over usb

I may suggest a VERY tricky and limited way to get uart over usb.

Hack MUIC kernel driver to multiplex uart on usb by shell command.

Port a bootloader (for example u-boot) -

Prepare u-boot build.

Load u-boot build to phone.

multiplex uart on usb manually.

kexec to bootloader build.

Repeat if necessary.

Add bootloader feature to switch uart on usb by key combination.

Chainload your bootloader with stock bootloader with chosen keys pressed.

Congrats, you got uart on usb at 2nd bootloader, and you'll be able to see early kernel logs, until kernel MUIC driver get loaded, and switch MUIC back to it's initial state.

Proofs of concept - u-boot code for Samsung A5 2017 - <replace with github url>dsankouski/u-boot/tree/a5y17lte/board/samsung/a5y17lte#getting-uart-output-via-usb-uart-cable

Note, I actually not tested this instruction, as I gone different way with A5 2017 u-boot port - soldered uart on motherboard
[Networking] sleonard:
My work is upgrading all of our WAP's on campus and my AT&T 8525 no longer sees any wi-fi being available. The new AP's are all Cisco 54G & B same as before but are newer models. Cisco recomended that we upgrade the drivers on all of our laptops but I can't find out what to do about my phone.

Scott
[Droid RAZR M Android Development] ProoN:
Hi there. I've got a Razr M (XT907) that I used as my daily phone. It's currently running a nightly build of CyanogenMod 12.1 on Android Version 5.1.1.

Was looking through these instructions and two quick questions.

Main one -- I understand this post is a few months old, but this write-up seems to be for Lineage 13.0 whereas the newest version of the Lineage nightly is 14.1. Is that [significantly] relevant?

Also, "qtmxt-r1.tdat" and "qtmxt-r2.tdat" don't exist in my \etc\firmware directory, though an "atmxt-r1.tdat" and "atmxt-r2.tdat" do. Is that just a typo?

Kudos in advance!

-Dan
[Droid RAZR M Android Development] DiamondJohn:
I haven't explicitly checked, but the steps are the same. The only thing that may of changed is you should also search the build.prop for "asanti"/"asanti_c" or such and change to "scorpion_mini" and also check for "PHOTON Q" and change to "RAZR M". Also check that there are no duplicates of the build.prop's I added at the end.

I currently build my own LOS13 from source, so haven't performed the above since they switched to Nougat; maybe once when they first switched. Without the customisations of Xposed, LOS is to vanilla for me.

Typo :o corrected. thanks.

I also improved/updated step 11

And also realised the GAPPS should now be for 7.x
[Droid RAZR M Android Development] ProoN:
Alriiiiight. So, I've got the latest nightly build of Lineage OS, edited all files according to the instructions up there and am ready to *try* to install/flash this onto my device.

The XT907 is currently running a nightly build of CyanogenMod 12.1 on Android 5.1.1.

From how it sounds, I just need to boot into recovery (I've got TWRP) and install via micro SD, correct? It just installs atop CyanogenMod? I'm not really sure how it works.

This is my daily phone and I just don't want to mess anything up.
[Droid RAZR M Android Development] DiamondJohn:
What version of TWRP do you have? An older version wont be able to flash the latest ROMs

Are you running the JBBL?

1st you need to make a nandroid (ie BACKUP) of everything you have

Wipe cache, dalvik, data & system (you do not need to wipe internal SD)

Then flash the LineageOS zip file

Then flash the correct (ie same) version of GApps (I use OpenGapps pico personally) 7.x if you have latest LineageOS

Then flash your chosen method for root (optional, either Masgisk or SuperSU, I personally prefer Magisk but have not tested either with LOS 14.1 I run LOS 13.0)

Then reboot. Give it 10min to boot the first time.

If it fails, restore your backup.

Good luck.
[Droid RAZR M Android Development] ProoN:
I keep backups of all my data, generally once a week or so. Data loss on the device isn't a huge deal, I'm more concerned about the phone itself being inoperable once I [attempt to] flash Lineage onto it, lol.

My device is currently running TWRP v2.8.5.0. And if I remember correctly, any later versions of it wouldn't work for some reason -- I tried a few. Though, I haven't tried any other recovery programs as this version of TWRP worked fine for flashing CyanogenMod on here at the time (2015..)

Also, I'm not sure what JBBL is .. exactly.

Kudos for the quick replies though, much appreciated.
[Droid RAZR M Android Development] DiamondJohn:
If you take backups (nandroid and sdcard etc), this phone seems pretty safe to flash ROM zips through TWRP (but never say never... and it is possible if someone gives you a zip explicitly trying to kill your phone)

I am pretty sure you will need to update TWRP again to flash these newer ROMs. For the latest see: https://xdaforums.com/droid-razr-m/general/twrp-3-1-1-xt907jbbl-t3652141

If you haven't taken the KitKat OTA or flashed the update manually, then chances you are on a JBBL (ie JellyBean Bootloader). Unless you bought the phone with KitKat pre-installed.
[Droid RAZR M Android Development] ProoN:
The phone was completely stock when I got it. There was a thread on here on how to unlock the bootloader, flash custom recoveries and OS's which is how I managed to get CM installed. How can I tell if JBBL is on here? Also, which version of Gapps would work for what I'm trying to do? (Lineage 14.1 on Android 5.1.1)

Sorry for so many questions. Kudos once again for the replies
[Droid RAZR M Android Development] DiamondJohn:
"Settings > About phone > Kernel version" then search and read XDA ( eg https://xdaforums.com/droid-razr-m/general/guide-faq-how-to-root-boot-unlock-t2869432

https://xdaforums.com/showthread.php?t=2226729

https://xdaforums.com/showthread.php?t=2758398

https://xdaforums.com/showthread.php?t=2345558)

Lineage 14.1 is Nougat. Nougat is 7.X so you would get that (eg ARM, 7.1, PICO from open gapps)
[Droid RAZR M Android Development] ProoN:
Will flashing Lineage OS on here update the Android system entirely from 5.1.1 to 7.x.x? I guess that's my main confusion here.
[Droid RAZR M Android Development] DiamondJohn:
You are OT,best to ask your question here https://xdaforums.com/showthread.php?t=2259645
[Droid RAZR M Android Development] ProoN:
Alright. So here's a not-so-newbie question. I went ahead and updated TWRP from v2.8.5.0 to v3.1.1-0 -- it was on another thread you had posted (the JBBL version seems to work on mine.)

Instead of trying to flash Lineage 14.1, I went along with the instructions for 13.0, edited the files and parameters accordingly, booted into TWRP and tried to install via zip and am getting this error

"Invalid zip file format!"

"Error installing zip file '/sdcard/lineage-13.zip"

Also have a copy of the zip file on the external_sd which reports the same error. I've tried this on both Windows and OSX with different zip programs and get the same error. Not sure what's happening here.
[Droid RAZR M Android Development] DiamondJohn:
So, clearly your zip file is corrupted by your doing/zip application, not the actual steps I have above. I personally use 7Zip (freeware), and have had no corrupted zips issues. And it actually is a pretty newbie question;) If you want help, put the actual TWRP log up here, what you have posted tells us nothing.
[Droid RAZR M Android Development] ProoN:
Alright, making progress here. ..kind of.

I was originally extracting the archive entirely, editing and moving where necessary and then re-zipping. I'm not entirely sure why that method doesn't work when trying to install, but it doesn't.

So yeah. I've got TWRP 3.1.1-0 on my device now (JBBL version.) I followed the steps above as far as I'm aware but am getting a different error now.

[IMG="TWRP and Lineage OS 13."]http://i.imgur.com/0XdCVgK.jpg[/IMG]

I used Notepad++ as well, though there wasn't a single instance of \r\n that was replaced when following the instructions
[Droid RAZR M Android Development] DiamondJohn:
The line "This package is for devices with a 4.1 bootloader" is basically telling you that you do not have a JBBL. ie you have a KKBL.

JBBL=4.1

KKBL=4.4.2

If you search these forums, there have been recent posts regarding installation zips (ie flashable) that can switch you back and forth between JBBL and KKBL for an xt907. eg https://xdaforums.com/showpost.php?p=73317190&postcount=13
[Droid RAZR M Android Development] DiamondJohn:
FYI: some of the reasons it could fail include (but are not limited to): Re-ziping can change the compression method (ie from simple STORE to compressed) and the zip file may (I dont think this one does) include some files which are case sensitive, while if re-zipped on Windows, chances are you are not on a case sensitive file system.
[Droid RAZR M Android Development] DragonFire1024:
I did a quick look over...but I might have missed it. Does any of this required an unlocked bootloader? Mine is currently locked.
[Droid RAZR M Android Development] DiamondJohn:
Look, read and think. The answer is staring you in the face.