yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
https://www.kernel.org/doc/html/v4.12/admin-guide/initrd.html

i almost got it working but jumping around a bit lol.. i was using the initrd from the actuall ENG binary boot.img
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
So this safestrap half works on our rooted system. It will give you the boot up option, by won't actually boot to anything. anybody good at compiling twrp?

You should definitely take a full flashfire backup before playing with this though.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
initrd is a boot time kernel thing, how does it help?

I think you misunderstand how Linux and it's memory management work.

I still don't understand how this is possible. The only way to interact with any physical hardware in a running system is through the kernel and only via syscalls. Literally everything fr from creating a process (fork or exec), allocating memory (malloc), everything is a syscall. It is not possible to read or I write to the memory the kernel uses, because they do not exist from a userland perspective, as they are not part of the virtual address space which is all you are given as a userspace process. The reason kexec did not work for us is that the kexec_load syscall does not exist in the s8 kernel as it was compiled without it.

Some kernels provide an interface to read/write to physical memory addresses directly through /dev/mem but as we discussed earlier that is disabled in the s8 kernels.

Given that module loading, kexec, and all other types of syscalls available to a process (at least I'm aware of, and I don't think I've missed any) are disabled in our kernel, I don't see how its possible in any way to manipulate kernel memory or context. This isn't a limitation put in place by security stuff, its fundamental to how the os is designed.

I guess also one way is a kernel exploit, so I'm still holding out hope for the coming Bluetooth bulbs, but unless you
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] coop_012:
Does this work on sprint variants
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Ugh, it uses kexec, so no. Our kernels have support for kexec removed. The e2fsck hack is super clever though and an excellent way to patch into the system early. If we get a pivot_root or something working, that's gonna be the place to do it
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] criswellc90:
Well since Sprint is not a US Variant, no it does not work.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] me2151:
Sprint IS a US variant...
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] criswellc90:
It's called sarcasm. The question he asked is answered by the 3rd sentence in the OP. He didn't read the 3rd line in the OP.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] ChrisJK7:
Is it possible to use this root to install an app as a system app, then unroot it while keeping the app as a system app?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Quickvic30:
No
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] gammaxgoblin:
So instead of one junk post, your insistence on policing this behavior creates a second junk post. In trying to fix about persons behavior, you doubled the problem. And you can't change people FYI. Yes this post does the same thing, see the issue?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
So how did you all figure out what is safe to write to the misc partition and in what format? I've done a lot of internet research to follow up and while I can find mention to it being something like "stores flags passed in for boot" I could find no specific instructions or lists or even vague explanations.

I guess I can just try writing some random **** in there that are boot args and see what's what, but if you all have better suggestions I'll be happy to follow them :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
This may have been what [MENTION=3812611]elliwigy[/MENTION] was referencing about locking download mode:

https://ge0n0sis.github.io/posts/2016/05/how-to-lock-the-samsung-download-mode-using-an-undocumented-feature-of-aboot/

Reading through the article it becomes clear that the exact address of the data matters. So, that begs the question, what is the exact address of FRIGATE_BIRD in steady, or the modes in misc, etc.? param looks to just be flagged very subtly, but I only used my phone to cursorily hex check.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Wired0980:
Then we have more "junk post" to complain about the first two "junk post".... and the cycle of junk continues...
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Thanks for that!

The way he said it sounded like echo > device but is it really that easy? I guess through an app it would make sense
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] braswellington:
I know a fix for 80% battery life that sticks from boot to boot. It still shows 80 but it will be charged at 100%. So if anyone is interested, I'd be happy to share.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Mark805:
How are u testing it that u are really getting the 100 % and im interested in trying out ur method
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
writing to max_battery_capacity? That was shared here before and people were very skeptical. I have looked at it a lot and it appears to help but for the s8 (at least mine) the hard ceiling of 1k is only 86%

If you have another way I'm all ears :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Mark805:
I dont have a fix i have it at 1k but its 81 for me i tried changing some of those files and setting them to read only didnt work for me
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
you are misunderstanding lol i wasnt referring to kexecload at all.. we are limited on the combo boot.img.. so initrd is awayfor us to make our own ramdisk and yes, it will work.. if u read up on it, ud understand how it works.. u can change root during runtime and have it reload the new rootfs and the way u get it to load on boot is by having the bootloader initiate it with your modified initrd.. initrd supercedes the typical ramdisk and the bootloader tells the boot.img to load the initrd..

this is how they do initroot.. it should be easiersince we arealready rootedbut ultimately we could be ro.secure 0, can use stock boot.img to fix battery etc etc
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
u are researching in the wrong places.. try on your device lol.. id start with rootfs, look at logs, browse the system etc etc
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] lastmoonchild:
Does rooting the sm-g955w require a pc?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
A PC or Mac yes

Also possible in Linux but I haven't tried it or heard much about it. Given that I do a my Odin flashing in parallels it should be fine in VMware too
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] mopartonyg:
Nevermind, not worth it.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
If you have something that hasn't been talked about here (use search), feel free to share
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] machx1111:
Has anyone else tried using SetCPU or similar ? Mine crashes after granting root.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
I just tried this older version and it doesn't crash. Tried new version and it freezes up. You report it to the developer for a fix.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jawonder:
Apart from Adell what are you guys using as a disabler or how are you guys disabling stuff ?. I want to disable Samsung theme so that a theme i installed will stick but none of the disabler i tried seems to work .
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] mdiaz33685:
I was using adhell but Samsung doesn't approve the license for rooted devices, I found another app using package info from the playstore and its free also.. https://play.google.com/store/apps/details?id=com.osp.pmanagerinfo&hl=en
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jawonder:
Thanks, do you install themes from outside the Theme store and get them to stay after 10 minutes ?.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] mdiaz33685:
No for using evvy black v3 theme, u have enable once everything is set u clear cache, then disable in dev options, running services, then package disabler go read the OP, he has for rooted and non rooted instructions, they will help u in that thread not this one.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jawonder:
Yeah i know it’s not for this thread and i’ve done all a that and it’s still not staying so i thought maybe do with the type of root .
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
why dont u use titanium?? lol
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jawonder:
Duh!!, i’ll try it .
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
yea thought tibu was THE freezer disabler to have with root lol.. without root i used bk package disabler pro
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] GSXeclipsePSI:
I posted this same problem.

My phone is blue. Don't see how color of phone makes it unrootable.

Did you get flashfire to work?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] TT_Vert:
It has something to do w/ the lead content of the pigment of the dye used on the particular phone.

Dave
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Interesting, mine only has SEC_IMEI, SEC_MEID, SEC_PR_DATE, SEC_SKU

(Not posting the values on a public forum though lol)

I wonder why yours has more
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
where did u go to find those?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Wired0980:
Lol.....i guess someone should post on every page of this forum how TURNING ON AIRPLANE MODE solves the flashfire issue......wait.....it is already posted close to every page......i mean how hard is it to search for "flashfire" in this forum......is the search button removed from certain people's app? Is that the problem, does the search button not exist on these different colored phones?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Flashman2000:
Hey guys I need some help! I've successfully rooted. While I was in root I made changes at the system levels to get rid of those scrappy emojis. After, I proceeded to unroot by flashing my stock BL, AP, CP, and CSC files via ODIN. I'm now on full stock but I noticed my emojis reverted back to the Samsung ones. Any help on keeping them even after I unroot? I'm willing to root and unroot again :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Where'd you find yours? :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
if u look at the lib files responsible for setting security including SB flag you will see they reference the flags as being in the /param partition

if u are able to view the /param partition and dont want to share how thats fine too, ill keep looking
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
dd if=/dev/path/to/param of=/tmp/param

hexdump -C /tmp/param
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] IJoxer:
It isn't so much a licensing issue as it is its dependency on knox to work. Adhell/2 utilizes knox to block ads "system-wide", however, being rooted likely means you have it disabled or safetynet tripped, making it useless.

Which brings me to a question about Magisk, I know the beta now allows flashing via flashfire/ss, basically removing the need for twrp/cwm. Now, I recall [MENTION=1949695]jrkruse[/MENTION] mentioning boot.img needs to be utilized for Magisk to be installed, but my question to those more familiar with systemless root, is there potential to eradicate that need, giving us a way to use Magisk? I'd be willing to help in any methods that would theoretically work, as this would open up a whole lot of doors for us. I know it's a bit buggy and limited in its uses, but it could certainly help with safetynet issues and other useful modules.

Another quick side note, though I'm not exactly established as a developer in terms of Android, I have been using linux for roughly 20 years (Fondly remembering Ubuntu 3.10:)) and a decent amount of debugging/programming experience. And of course my experience with rooting/flashing/debugging in android. I guess I'm just curious if there is anything we less knowledgeable folk can do to investigate possible bootloader bypasses/exploits? A list of main points of interest would be very helpful, I love sorting through logs anyway, it's like working out a puzzle at times.

Thanks!:good:
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Johnkron21:
Just got an error. Went to [Upload mode] Subsystem crashed : modem.. Any ideas
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
to my knowledge no.... one of the reasons magisk works to hide root is bcuz it doesnt modify the system partition which helps to pass safetynet and other checks.. it modifies the boot.img instead
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
search the thread
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] kleen3r:
Flash CP and CSC from your carrier's stock firmware. Download is at updato.com.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
And NON_HLOS.bin from the BL tar. It's the lte radio firmware for your device but it's in bl because it's apparently involved in secureboot somehow.

My guess is it has hw encryption modules for doing secure lte and so it makes sense to do openssl there. Just a wild guess tho
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] IJoxer:
Ah, well damn, I suppose that makes sense. Now, if we were to get SS working for our devices, which I believe somebody mentioned there is a nearly working version right now, would it be possible to use that to obtain systemless root? I understand we still wouldn't be flashing a boot.img, but it does allow us to load a custom kernel into ram, didn't it? It's been a while, we've been spoiled with FF, I'd look but I'm off to bed. I wish I enjoyed going to work as much as I did digging into this stuff lol. To be continued, have a good night all!:good:
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Do you know details of how magisk hides? Is it more than just not modifying system? Cause it's totally possible to carve off a chunk of the internal storage (or even a removable SSD), install magisk on it, and mount it from a very small edit to init.d. I have no idea if that's useful though cause I've never ran it
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] IJoxer:
I've looked a bit into it, and figured it had to be able to run on any device, theoretically (thus the term "systemless root"), but I'll be honest, I haven't looked too closely at it. One, because it's a fairly new concept still, not to mention very buggy and unreliable. Two, because it will forever be playing "keep away" from each and every update, regardless of carrier/manufacturer. And third, because I always tend to stick with, for whatever reason, our wonderfully locked down Samsung (snapdragon) devices, which we've almost always had some method of root, albeit unoptimized methods from time to time.

So, you believe Magisk can be utilized simply by loading it it into it's own little partition and initiated at boot? I could be wrong here, I know init.d can be quite the workhorse, but if it were that easy, it'd almost certainly be put into practice at this point. Now I'm curious what they are flashing in odin/FF using the current beta build to bypass the need for custom recovery, and if we could maybe implement SamPWND into that file. I'll definitely be looking more into that tomorrow, but seriously this time, gotta get to bed.

To be continued...
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
We have an init.d already, SuperSU installs su.d which is the same thing.

The trick is finding a place early in the init process that somethjng on /system gets executed. There are two I know of, one is install-recovery.sh which su.d uses. Another one used by safestrap (which we can't use either ugh) which I need to verify still but someone said on XDA the menu worked when they flashed it which would indicate so is /system/bin/e2fsck

I think that one will be perfect because Linux fscks disks before even mounting them, so in theory we could trap and maybe do overlays! I think this is my project for tonight :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
i think any modifications to boot will cause secure check fail.. would be hard to edit init without modifying boot.img.. all i know about it is safetynet and other checks check for modified system so magisk has to avoid system modifications when rooting
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Yea I mean if we mounted a partition at the same time we do SuperSU now would that be enough? Or are there things magisk needs to do at boot to do its thing. Sorry I've literally never even seen it beyond one install on my N9
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
youre best bet would be to read up in the magisk threads lol i nvr used it much either just kno it modifies boot.img
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Cool will do. Thanks
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
pretty sure init.d is mounted in the system partition which would essentially make magisk useless if system is still modified lol
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
Can these root detectors (they use dm-verity right?) pick up a few line changes to a single file? I guess I initially thought maybe they couldn't be that exact (you could branch off system into a separate partition with VERY little shell/initscript) given the wide variety of stuff out there that modifies system but you're absolutely right if ANY system change is detectable then we are SOL.

What I'm personally curious about is if they can be that sensitive how does magisk hide and how are their boot.img changes not detected given its a few orders of magnitude smaller of a surface area. Why do they not just check the boot.img signature like the locked bl does? I'm obviously missing some piece here I will go figure it out :)
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] maloneyish:
when i go to ad firmware in flashfire it just loads forever does any one know ho to fix

Add files to flashfire in airplane mode fixed my problem
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Tyler4256:
I have a big problem, so I tested out the root guide. I successfully got the root but root is not very stable. Plus I don't like the custom mode it unlocks and implements on the os. Well I want to flash back to stock ROM. And Odin is not letting me do such thing. I can load all of the ROMS in but when I try to load in ROM AP it just loads. Then it says the application is not responding. So I tried what the guide said. So I tried the AP ROM in both normal and cosmey Odin. But still said please wait as if loading and then the application would say not responding. So can anybody help me unroot this sm-g955u? I have the stock ROM firmware if anyone else wants it. Lol ps I hard bricked my phone when I tried flashing it without an AP ROM but I got it back by flashing all the root ROMS again.

Thank you in advance for any help!
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
because thatd be less secure and more easily exploited.. u also have to keep in mind the the kernel/boot runs at a higher privelege than the system does for security reasons which is why the boot verifies the system partition.. i think if the changes are processed by the boot.img itself it appends system changes to the dm verity table so it registers as being secure..

the system/runtime cannot verify the boot as its the other way around..at least thats my theory lol

secure world vs. user world.. thats the whole reason they started systemless lol, so system shows as untouched and root is basically running at a more secure level
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] criswellc90:
I would read any page of posts between 20 and 321, and then look to the OP to see how to get Flashfore working. If you can't do that, go get an iphone.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
Sounds like you have old or slow computer. Usually takes a minute to verify the md5. You can try opening the AP file with regular Odin, step away, and come back in 5 minutes.

If it's still frozen up after 5mins, you can try retarring it with 7-zip or the like. There's a few different ways to try this. First you'll need to extracting the AP firmware file. 1: create a tar archive with all the extracted AP files, then flash with regular Odin. 2: Create a tar with everything but the meta-data folder, and flash with modified Odin.

Edit

How is it unstable? It's pretty stable if you do part 1 & 2. I'm running my AQGL system.img and it's stable AF
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] partcyborg:
So I did a bunch of reading about magisk for those that are interested in the feasibility of having a sd n8/n8+ version

Let just start by saying holy crap they have come a long way. Magisk is basically most of an os itself these days. While I have theories that it might be possible eventually to run a unique to the g950x us snapdragon devices but it likely wouldn't be an install it would be a full ported os. There's just so much going on that it will be that kind of an undertaking to make it work in a way that fits with our setup.

Im going to keep looking at it closely but I wouldn't expect anything concrete anytime soon.

More later
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] elliwigy:
how do u propose this without modifying the boot.img? every method ive seen requires boot.img to be patched/modified
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] jhofseth:
can we neuter SELinux enough?

Can we neuter SELinux enough and find a way to with enforcing get back 20%?
[MENTION=3812611]elliwigy[/MENTION] , [MENTION=8360749]wildermjs8[/MENTION]

https://xdaforums.com/android/software-hacking/devs-compile-android-selinux-binaries-t3615942/post72522336#post72522336
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] IJoxer:
I thought init.d was its on the root partition but outside of system, at least it is in most Linux distros, but may be different for Android as they love to take away our only methods of exploitation.

---------- Post added at 02:18 PM ---------- Previous post was at 02:14 PM ----------

I've already pointed out that have the beta builds working without boot.img, flashes via FF I believe.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] hazmad:
others and I have already tried messing around in the area. The only way I've been able to charge to 100% is through user boot (stock). But that's enforcing, and doesn't allow you to do anything above user privs. The only way I see forward is with an exploit (broadpwn, blueborne, etc.), in order to use su binary with user boot. But I don't think we have any exploit coders on board.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] the1stSecond:
Did you get this figured out?

I am having same issue with my Xfinity device. I downloaded the CCT firmware from same place I have previously, but who knows, maybe its not really CCT firmware?

Edit 1-Tried CCT firmware from SamMobile and got same result regarding dismatch. Trying U1 CSC this time.

Edit 2-U1 Home CSC flashed immediately and with zero errors. Weird.
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] vzdragon:
Where are you headed?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] kclive:
ANYONE?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] Raz12:
seems like everything is good everyone that helped me specially boostnek9 with the PM. You guys said the CSC might be messed up ? it doesn't seem like it but how could i tell ?
[Samsung Galaxy S8+ ROMs, Kernels, Recoveries, & Ot] astonat:
you are amazing!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!