yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] meathammer386:
Im simmered down i just answered your question and gave you some advice its up to you what you do with th info i just gave you as i used the search function just for you since you didnt know how well now you do thank you have a beautiful day
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] TT_Vert:
BTW, I didn't ask the question..
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
u cant flash it at all.. its eng binary says use user bibary.. even if u dd it it will not boot and say to use eng binary..

you can extract the ramdisk no prob then have to use something like pivot_root to load it
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Ugh bummer. I was hoping it was the bl (shoot?) that was picky not the reading of a signed boot img.

Pivot root / switch root (a cleaner ver) does not give us custom kernels, which doesn't give us fixed battery and whatnot. Custom root is still awesome and worth it don't get me wrong but it's why I was trying for kexec.

Kexecload does not work in the same way kexec doesnt (there is a test mode that fails with function not implemented).

I thought you were able to flash eng boot to some limited degree I seem to recall a screenshot as the loader page is diff than the user-test one. Am I remembering wrong?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] 94tbird:
I flashed those from the stock firmware they flash okay but I'm still getting the subsystem crash modem errors looks like still when I lose signal or when it's trying to transfer from LTE to 3G the error message has something about an invalid LTE vco something or other
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Flashman2000:
Quick noob question here, if I root the s8+ and make a system level change like replacing the emojis, will the changes remain when I unroot? Or does the unroot process use flashing the default system file?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] TT_Vert:
Does it reboot into upload mode? if so I had that at one point and a reinstall helped. Confirm everything is on QGL

Dave
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] 94tbirdevo:
Yes it reboots into upload mode and States Sub system crash modem an invalid combination for the LTE VCO or something to that effect

when you say a reinstall helped are you talking about redoing the entire root process from scratch? can you give me a little more detail on what you mean
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] TT_Vert:
No, just reflash the system.img/supersu zip in OP and then reboot/flash CP/CSC.

Dave
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] masterzoltar:
don't know if this was addressed here or not, I tried searching but no luck. the first s8+ I did everything is A+. my other one has the hurricane icon on the notification bar. how is this removed? on

---------- Post added at 07:53 PM ---------- Previous post was at 07:52 PM ----------
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] cameljockey1:
Anyway to change the OEM unlock to 1? See screen shot. All I did was go to terminal and type "getprop"
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
The changes to /system persist across factory resets so things like emojis stay until you flash something else.

Keep in mind though that you probably can't go back full stock with root mods due to dm-verity and friends

---------- Post added at 02:00 AM ---------- Previous post was at 02:00 AM ----------

Lol it's 1 in the eng rom, but it has nothing to do with bootloader it looks like a gate also for frp
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Araltd:
At the risk of sounding rude, are all the files on the OP still current and relevant? I see a mention of AGL for Tmobile but the linked file in the OP is QG2.

To be clear, the process has worked fine on 2 S8+ for me, first try - no errors.

MANY THANKS TO THE POWERS THAT BE.

It's taking me a BUNCH of time to read thru 300+ pages at this point, so I thought I'd ask :D
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] THE GEEK 19:
Hey guys, so a few minutes ago i was unable to gain root access on any root apps. And before you ask, no i did not install or change anything since i rooted my phone. So, like i usually would do, i rebooted my phone. Now it won't even pass the "custom" screen and i can only briefly access Upload mode and i can fully access download mode. Any thoughts on how to retrieve my data? I don't have much time as i have to work tomorrow bright and early, so any help would be appreciated. Is it possible to flash full stock tmobile rom using home_csc so i don't lose data? Or will that still not allow my phone to boot? Thanks in advance. I will try to reroot if i get my data back and see if i can replicate the problem so i can give you guys system dumps and logs in case it's anything that can be fixed before it happens so that it doesn't happen to anyone else.

Edit: I also cannot access recovery.

---------- Post added at 02:22 AM ---------- Previous post was at 01:47 AM ----------

So i attempted to flash back to full stock using the home_csc instead of csc file and it would stay on the Galaxy S8+ screen so i did a factory reset. It is now currently on the bright white t-mobile screen. I'm pretty sure it will boot. Also, I noticed a userdata file in the original stock firmware files. I'm a bit new to rooting since a lot has changed since the galaxy s. Just curious, thanks for your work devs. Root was the best thing to happen to the GS8.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Thinh Le:
Is anyoje attempt to put your phone back to stock and fail?

Mine is SM-G955U1, baseband G955USQU1AQDE

I failed right at the beginning, can't find the damn 4 files that match mine spec on updato.com

If anyone happen to have the same model and baseband i have, please help me. Appreciate all.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
u are mistaking the eng bootloader with the eng boot.img, they are two completely different things.. the eng bootloader (abl.elf) is flashable...

eng files NOT released are abl.elf, devcfg.elf, boot.img and recovery.img.. the boot/recovery are the only partitions that cannot be flashed..

eng bl and devcfg were not released because you cannot root when usibg them with stock boot/recovery as well as they wont boot with permissive boot/recovery and then the eng boot/recovery dont flash at all since we do not have eng devices

and pivot root/switch root can do a lot more than you give it credit.. we would be able to load our own kernel into ram (even on boot) if done correctly which would allow us to inject our own cmdline potentially allowing a secure boot bypass or maybe unlocking the bootloader.. basically if we can do our own command line injection we can have the bootloader inject for us instead of from the boot itself
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
it has everything to do with bl unlock lol when its 1 means its allowed but since we dont have fastboot we need to determine how samsung unlocks their bootloaders which would probably require reverse engineering
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
to add, you can enable atags with a build.prop edit:
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
pivot root vs. switch root busybox applets

I agree pivot root sounds like it would be more compatible with SamPWND, but I wonder about the change from initrd to initramfs.

From the pivot root applet code (linked), "Note: This is for initrd in linux 2.4. Under initramfs (introduced in linux 2.6) use switch_root instead."

https://github.com/sherpya/android-busybox/blob/master/util-linux/pivot_root.c

https://github.com/sherpya/android-busybox/blob/master/util-linux/switch_root.c
[MENTION=8360749]wildermjs8[/MENTION]
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] studlyswissdude2:
Tried this on Galaxy S8+ (VZW) and it's not working for me. Either crashes or says couldn't connect to Netflix and closes. Has anyone actually gotten this particular APK file installed and working?

---------- Post added at 06:25 AM ---------- Previous post was at 06:13 AM ----------

OK, my bad. Got this working by uninstalling Netflix again, then going to /system/vendor/lib and renaming the liboemcrypto.so (to liboemcrypto.soOLD or whatever you want it to be). Then restarted, then installed the APK, rebooted again, then opened Netflix app and was working like a charm!
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
>_<

Yea I had it backwards my bad. Too bad.

Hmm are you absolutely sure, like have you seen this done? I only ask because every bit of documentation including the official manages for the pivot_root userland tool ( ) (which basically is nothing but a shim) and the accompanying kernel syscall () are very specific in their explanation that these are userspace manipulations, meaning nothing anywhere near ring0 is affected. The second one shows a very broad example of using the tool, and the only thing you can give it are a filesystem (ramdisk, initrd, block device from premounted /dev or /sys etc). No where do I see anything about any ability to do something like bulk allocate a new kernel structure jnto ring0 or setting an arbitrary jump point in memory and making the existing blindly follow it and do needful things like safely hand off all controller management.

I really, REALLY hope I'm just being dumb and missing something glaringly obvious, but as of now every single other method for injecting arbitrary stuff into ring0 has the ability to be turned off at build time via Kconfig and is turned off in the kernels I have been able to find and boot on my s8. I am looking at ksplice right now which supposedly works with "every kernel with no preconfig needed", however it's a commercial Oracle product now so their oss docs are close to useless. I'm going to give it a go anyhow, but I'm 95% confident I will hit a brick wall here too though as the docs talk about rolling out the splice by doing an insmod, something explicitly turned off in the s8 stock kernels

So yea, if you can point me at where you saw or learned about some way to get out of ring0 too that would be awesome.

Also please don't think I am not super excited about being able to deploy my own system rootfs :) :) :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
You're right >_< this is what through me off. After trying some random "eng boot" boot.img from flashfire my device currently looks like this:

*EDIT: That is how the file shows up in my ramdisk, I didn't change it. I figure that it's been that way and I just wasn't as aware
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Unfortunately that is a different kind of "named" tags.

Those are around doing ktrace like performance analysis stuff at the syscall layer. The atags I was referring to are an out of date microcode config standard of some sort for specifying the physical hardware an arm host is booting up in for the first few seconds of power up. It's also not used by Samsung at least publicly as the dtb files are the new and very widely used standard
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
mine has both defaulted to allowed or 1
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
i dont see why they would compile it and include it if it wasnt supported.. i amsure tgere is a way to enable it, just have to look.. theres much you can do on eng firmware including booting into special modes such as ffbm mode...

also, if you push a command into the misc partition andboot into recovery it runs it as a "boot command" so i amalso currently looking into this
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Does it stay 1 in getprop like mine does? Setprop does not throw an error but it never changes from 1 there
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
yours dont both show 1.. theres 2 prop settings supported and allowed...
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
the attached pic is the problem tho, part of it anyways..
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] bill10:
Ummmmm what?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
ummm what??

u have a question or just dont understand the post or what lol..
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
dd kernel code in RAM both ways (patching, etc.)

cat /proc/iomem (address min/max)

80080000-8172ffff : Kernel code (RAM)

817e0000-81e9bfff : Kernel data (RAM)

after hex to decimal conversion (size as absolute value after subtraction)

2148007936-2171797503=23,789,567 Kernel code

2172518400-2179579903=7,061,503 Kernel data

But, I need to determine exactly what /dev device(s) to use with dd.

POSSIBLY similar to this, but numbers could change:

dd if=/dev/??? of=kernel-code.dump bs=1 skip=2148007935 count=23789567

[MENTION=3812611]elliwigy[/MENTION] , [MENTION=8360749]wildermjs8[/MENTION]
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] bill10:
Lol don't understand at all. I'm a doer lol
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] bill10:
ok so I just rooted my phone and this huge button came on my phone app? Anyone know how to get rid of this
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] 94tbird:
Still getting the modem crash errors. Any other ideas?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] kleen3r:
Try to flash the system.img from the stock Sprint U AQGL firmware. Then CSC and CP from that same firmware in Odin.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jrkruse:
What about this https://stackoverflow.com/questions/38068020/how-to-disable-kernel-module-signing-in-android-by-adb
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
delete
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Araltd:
Wireless charging gets phone hot. My guess is it continues to charge after it reaches 80%. I'm a little worried about that. Back of phone is warm in the morning. (still only charges to 80/81%)

Anyway to get unknown caller ID working like the U1 firmware smart call (or smart caller) feature? In the phone app identify unknown callers is ON but it doesn't.

Sorry if the questions have been properly answered, I'm late to the s8+. Still learning
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] letsflyak:
Can you flash TWRP with this? I just tried with the official app and got a message saying i got unauthorized software and run, don't walk to the nearest at&t

---------- Post added at 12:00 PM ---------- Previous post was at 11:54 AM ----------

Nevermind dis a search and found the bl is still locked on these suckers. Can anyone point me in the direction to installing custom to me on these phones without twrp?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] sreza4:
If I root my phone is there a trade off with battery? Last time I rooted my s7 active the battery only lasted 3 hrs
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
I think you can do the same thing in rooted Android terminal emulator via:

su

setprop module.sig_enforce 0

But, I think we may have better luck with dd. dd is reliable even when other newly compiled binaries have all sorts of issues that need to be ironed-out. What do you think?

-------------------------

"dd kernel code in RAM both ways (patching, etc.)

cat /proc/iomem (address min/max)

80080000-8172ffff : Kernel code (RAM)

817e0000-81e9bfff : Kernel data (RAM)

after hex to decimal conversion (size as absolute value after subtraction)

2148007936-2171797503=23,789,567 Kernel code

2172518400-2179579903=7,061,503 Kernel data

But, I need to determine exactly what /dev device(s) to use with dd.

POSSIBLY similar to this, but numbers could change:

dd if=/dev/??? of=kernel-code.dump bs=1 skip=2148007935 count=23789567

[MENTION=3812611]elliwigy[/MENTION] , [MENTION=8360749]wildermjs8[/MENTION]"
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Pazzoevil:
Just a few questions

Will this work for my Samsung Galaxy s8 plus I have att
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
This is not the issue. CONFIG_MODULES is set to n on the kernels run by the stock and combination firmware. this means that the kernel is not capable of loading modules in the first place.

TBH if I was trying to prevent tampering of a system myself I would have done the exact same thing immediately :/

Also, if you could just dd code into memory for a kernel patch there would have been no need to build ksplice and kexec :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
Yes, but kexec will never work for us until we have a different kernel. Ksplice might but opensource for that is way old. I have no faith in Oracle, either. We have dd. I am confident the issue is not a module but a driver. All or nothing at this point. Modules are .ko, but the kernel has baked in drivers.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Ksplice itself is OSS too as it's GNU license. It's only the service they provide that is proprietary

I'm holding out hope for ksplice but I'm not holding my breath. I'm guessing as kexec_load and config_modules is turned off they likely turned off all ways to inject ring0 code. It's pretty simple and easy to think of for anyone who is even relatively doing their job in security :D

On a brighter note, did you see the Bluetooth vuln that was announced recently? The s8 is vulnerable I ran the test app listed in the XDA article on the front page news and it confirmed. I haven't looked closer yet (at work) but radio drivers are always kernel level and ring0, so maybe we can get in that way and change stuff?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Wired0980:
FINALLY!

We Present To You

SamPWND!

Root for the USA Variants of the S8 & S8 Plus Devices!

(This thread will focus only on the S8+)​

Did you not read the OP? Do you not know if AT&T is a US variant?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
identifying kernel code RAM in /dev and hexedit comparing kernel images

Not yet. It would be nice for sure! Right now, I am focused on finding proper device in /dev for the RAM dedicated to kernel code. Concurrently, I am hexedit comparing kernel images between SamPWND and latest T-Mobile. When I have the proper RAM /dev device containing kernel code, I will be able to compare with SamPWND kernel image and identify shared code.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] meathammer386:
No lmao
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
Yes, same model. I have T-Mobile but we have same phone, and this is the right thread for you. It's kind of confusing because Samsung sometimes uses different model numbers for different carriers (e.g., with Note 5), but not with the US Snapdragon S8/S8+. SM-G955U is carrier locked version of US Snapdragon S8+.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] studlyswissdude2:
LOL :good:
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] ToF_Itachi:
So I have been successfully rooted ever since this post was made! Fun fact I also had my first OS crash too. It mentioned something about a modem. Can't recall all too well but it's no biggie. Love the root!
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Wired0980:
Flash your stock cp and csc file in odin and your modem won't crash anymore...
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Apparently these are all turned off in not only android, but all linux by default for years :(

These are the two possible ones:

dreamqlteue:/tmp # dd if=/dev/kmem of=/tmp/sorry-man-doesnt-work
0+0 records in
0+0 records out
0 bytes transferred in 0.001 secs (0 bytes/sec)
dreamqlteue:/tmp # dd if=/dev/mem of=/tmp/sorry-nope-either
dd: /dev/mem: No such file or directory

There are hacks to get replacements in place, but they require loading a kernel module :(
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
/dev/mem and /dev/kmem access can be restricted at compilation. Merely making nodes as per /dev/mem manpage doesn't allow them to work. I wondered if Samsung might have disguised or renamed.... Not many people know that access can be allowed at kernel compilation. /proc/iomem is very helpful, more helpful than /dev for sure! I am searching for a way to re-enable restricted access to /dev/mem & /dev/kmem.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
They didn't have to remember, stock kernel sources come preconfig with it off for years :(

They would have had to explicitly turn it on

---------- Post added at 12:15 PM ---------- Previous post was at 11:59 AM ----------

hlos? I don't see a file called that anywhere in ap...

There is a NON_HLOS.bin in BL, but....
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
That's what I meant, those should fix problems with modem partition. If that doesn't work, you should try a complete fresh install.

...but what?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
I was leery of flashing random **** in the BL image haha

But I just flashed hlos from latest U1 firmware and boot.img from latest combination (there is an AQI1 that JUST came out!). So with a modern kernel build and matching lte drivers maybe my phone will be less buggy.

Here is hoping they squashed the green screen bug!

Thx to [MENTION=3812611]elliwigy[/MENTION] for the tip about the boot.img from the combo factory rom. I'm actually rooted with modern stuff!
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] LiquidT:
[MENTION=3812611]elliwigy[/MENTION]

Sent you a PM
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] akinkoff85:
where we at on a battery fix? I have seen a few ideas thrown around
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] thesavagetony:
Has anyone found a fix for the random yellowing of the screen and choppiness, fixed by a reboot? It seems to be happening multiple times a day and it's super annoying.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jeffyv2:
I lose data after a while after I root it seems now for some reason I see the LTE indicator but don't get data is there a way to fix this?

Sent from my SM-G955U1
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Flash no_hloc from the bl tar of the firmware you're running and modem.bin from ap I think of the same
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jeffyv2:
Flash them via how? And do I need to make a special zip or something?

Sent from my SM-G955U1
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Flashfire just like phase 2
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jeffyv2:
So extract those from the files and flash

Sent from my SM-G955U1
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Yep
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] criswellc90:
It sounds like the two of you didn't finish step 2 of the root process successfully.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
it's an engineering/debugging option

Nowadays, the option to allow allow acess at compilation exists primarily for engineering/debugging purposes. The specific option is CONFIG_STRICT_DEVMEM: , which filters access to /dev/mem.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Very true, but based on the state of the sm-g950u kernel source I would be shocked if there is significant engineering going on in kernel, and I'm sure none of what is there needs raw memory access :(
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] thesavagetony:
At least for my issue, I don't think that's the case. Root functionality works perfectly fine, and I've re-rooted the phone on three separate occasions, the yellow tinting happens every time, and i've followed the instructions to a T.

Not to mention that multiple people have mentioned it in the thread.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
misc partition boot commands

I wonder how much we can alter for SM-G955U/950U via misc partition boot commands allowed with ENG boot?

cat /proc/cmdline
[MENTION=3812611]elliwigy[/MENTION]