[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I think it's time to get this party started.

There is hope ->> Initial Analysis​

I have built a spreadsheet that takes a hexdump of the GPT tables and decodes them.

This provides the means of generating the Partition.xml and Rawprogram.xml.

Also one can learn alot by analyzing the GPT.

With the ability to generate the partition.xml it can then be converted to partitions.txt that the Dragon-Board db_boot_tools (mksdcard) can be used to burn the SD Card.

The ability to build the rawprogram.xml also provides us the opportunity to build EDL roms and flash them using the emmcdl.exe or the QDL download tool for dragonboard.

This means we can build unbrick roms / anything we want and flash it in edl mode unrestricted.

Currently there is available the Factory Samsung EDL Recovery Files for Boot Loader Rev 2.

https://www.needrom.com/download/unbrick-samsung-qualcom-9008-files/

I have looked at them and they are legitimate.

Analyzing the GPT tables included in the EDL package I can determine that these are Standard Qualcomm Bootloaders that operate on a Standard QC partition table.

My theory is that being standard Qualcomm Images the bootloader is unlockable by standard Qualcomm method.

The board_info partition. As seen here.

https://alephsecurity.com/2018/01/22/qualcomm-edl-2/

Another great resource is everything for the dragonboard 820c. Its the same chipset.

A ton of available source code is at our disposal.

In a nutshell because i dont have a lot of time to get into details at the moment.

I ran my first SD Card Test.

Simply burned the Dragonboard 820c SD Rescue image to a sd card.

https://www.96boards.org/documentat...board820c/installation/board-recovery.md.html

To my surprise if you insert this SD Card into the device and boot into download mode.

You will see FRP=OFF.

This proves my theory that the possibility of booting a full system on a sd card is real.

The sd card is read early in the boot chain.

I have to investigate and see exactly how this is setting frp off.

This partition table has the FRP partition.

The note 8 uses the persist partition for the frp switch.

So how the sd card is turing FRP off is the question I am working on answering at the moment.

I can conclude.

The device is definitely reading partitions off the SD Card.

It is beating the FRP lock out of the box.

This means either the stock bootloaders have functionality built in to look for the FRP partition that normally is not present on our devices. Meaning the stock bootloaders can read other partitions of the sd card.

Or somewhere in the boot chain one or more of the dragonboard bootloaders are executing off the sd card.

If that is the case Hope is very Great for us. Dragonboard has available the LK source code that we can modify and build.

Dragonboard also has pre-compiled bootloaders specifically for booting on sd card that we can use.

Also the samsung bootloaders in the EDL files are very promising.

If we can build the aosp system to go with the edl bootloaders ( If they are unlockable ) were golden.

If the Dragonboard Bootloaders are executing on the sd card were even more golden.

If this is the case we can even use the dragonboard 820c AOSP build ( includes sources )

All we really should need to change would relate to hardware differences.

Seems crazy but there is no rational explanation as to how the sd card turns FRP off other than the possibility of somewhere in the boot chain the drangonboard BL is executed on the sdcard.

Unless like i said the samsung bootloaders have the stock qualcomm functionality as well.

Either way you look at it. We defeated the FRP protection by flashing a sdcard and booting with the sdcard in the device. That is enough proof in itself that there is hope.

It would be superb if some of the other Samsung Devs, Like the samfail team would climb on board to work on some of this. I am very skilled in some aspects and in other aspects i could use some help.

Either way give me a couple months and we will be there.

My only question is has anyone ever been actually paid by Samsung for finding Exploits?

From what ive read on there site it says $200,000 K or more for a bootloader unlock.

Makes me wonder if I should be sharing this information with anyone.

But money aside...thats what samsung wants. There using greed against us. They don't want us to work together.

I will be getting into some very deep presentations of my work as time provides.

That way the community can learn and help on this exciting journey.

Damm I still can't believe it turned FRP off. :silly:

Just goes to show ya. Don't doubt it till you try it no matter how far out it may seem. :highfive: