yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I just came across this.

A very helpful document that certainly is useful if you want to know about secure boot and blowing fuses. Also has information on the anti-rollback.

https://github.com/dongyongzhi/andr...45_Application Note- Enabling Secure Boot.pdf
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Much more there

Yea there are more documents at the bottom of the repository.

Get them while you can. Some of these are hard to get.

This is a nice one.

https://github.com/dongyongzhi/android_work/blob/master/80-NM248-3_FUSEBLOWER TOOL USER GUIDE.pdf

Exactly what we are dealing with.

https://github.com/dongyongzhi/android_work/blob/master/80-NU861-1_QUALCOMM ANDROID SECURITY.pdf

:cowboy::cowboy:
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] devdawg8:
Thank you so much for your hard work! Will we need a Dragonboard to unlock the bootloader?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
No you don't need a dragonboard.

I have a dragonboard410 because its cheap $75.00 and its totally unlocked, truly a Development Board.

Truly UN-brickable.

There is a ton of guides and full access to Qcomm Board support packages. The source code that we usually can't get. There are 2 versions. The dragonboard 410c and the dragonboard 820c. The dragonboard 820 has basically the same chipset as the Note 8.

U-boot has been developed ported to the dragonboards by others already.

Seeing that the dragonboard and the note8 have close to the same chipset and there is lots of documentation I choose it as a starting point for the note 8.

Using U-Boot is not truly unlocking the bootloader. It's a workaround like kexec.

If I find a way to tftp boot U-boot you will need the ethernet adapter. But hopefully if I can get the tftp boot part working as a binary I can get bootm working as a binary and then you wont need the ethernet adapter.

The negative side of TFTP boot is you will only be able to boot up your custom system with the note connected to a computer. When not tftp booting it will boot the normal system as it does now.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] SomeGuy2008:
Reminds me of the days (several years ago) when I had an iPhone 3G that had a tethered jailbreak (required connecting iPhone to a PC at each boot). Otherwise the iPhone wouldn't boot up at all.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Lucky for us we can use safestrap to control our boot.

We can place a file to flag TFTP boot.

So as safestrap starts if the file exists then boot U-boot over TFTP else continue as normal.

For tftp booting the rom and the boot.img or kernel to load will exist on the sd card.

That way other than flashing safestrap no modification of the internal ufs is needed.

The only catch is we need U-boot functionality from android userspace.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] xRaZeR_FuZioNx:
Well, one possible way could be breaking out of userspace on the phone, no? I don't know how much access we could get from escaping the userspace.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
What we have to use to inject U-Boot is the safestrap environment. (Userspace)

Now what i mean is we are replacing the normal e2fsck binary with our own shell script.

The e2fsck is automatically run when the device boots up. At this point in the boot sequence we have just finished loading the android kernel.

If we could hijack the boot process prior to loading the kernel tings might be a little easier.

But the reason all this can work is because at the point where the kernel is loaded all of the secureboot checks have passed.

As far as access we have all the access you can possibly have. E2fsck runs as root user under (#!/system/bin/sh)

not (#!/bin/sh) so there is no limitation on the read or write and execution.

There are 2 ways U-Boot is normally run.

It can be flashed in place of Little Kernel ( aboot ) or it can be flashed in ( boot ). When replacing little kernel that's exactly what it does. It replaces the aboot partition and becomes responsible for loading the android boot partition after it initializes hardware and other stuff.

When it is flashed to the boot partition then little kernel -->> aboot loads U-boot just as if it was the normal android boot.img. Then U-Boot is responsible for unpacking the ramdisk loading the kernel and the device tree then starting android.

So we want to use it in the second case scenario.

Problem is that TFTP Boot is a function of U-Boot. And we are trying to boot like this.

Aboot -->> Boot -->> Hijack -->> U-boot -->> Android

Normally it would be.

Aboot -->> U-boot -->> Android

And to tftp boot or load files to ram with U-Boot is done with the U-Boot shell.

They get into U-Boot shell by rebooting and interrupting the process at which time U-boot drops to the shell.

U-boot is basically loaded like the normal android kernel and has control of the system until it passes control to the kernel. Once U-boot passes control to the kernel U-Boot and its functions do not exist. They are replaced by the kernel.

So in a nutshell we need to reverse the process. We need to load U-Boot over top of the kernel and pass control from the kernel to U-boot. TFTP Boot can do this but like i said its a function of u boot. If we can compile that function as a stand alone binary then execute it within our e2fsck script then we are in business.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] DroidisLINUX:
Isn't that what fish is for, if you get fish to work properly you should be able to kill the Android user space and reload the system from sdcard I thought that was how fish worked, so you should be able to load to safestrap have it load fish and have it execute a new boot process and boot from a sdcard data.img/system.img/cache.img lol I ke a safestrap recovery backup on slot 1 or 2
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Almighty1:
Speaking about the kernel, where exactly are the kernel files located on the device?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
The Mysterious Kernel

The kernel is packed in the boot.img and the recovery.img in the boot and recovery partitions.

Usually it is compressed as zimage or for U-Boot it is uimage.

You can unpack a boot image and decompress the kernel then provided there is enough space in the boot partition you could repack the boot image with the uncompressed patched kernel and it will still function the same. On devices that are unlocked you could do these things. Even build your own kernel and use it. But on a locked device you can't even unpack the boot image and repack it without making any change at all and it will still fail security because it is not signed. In many cases not only the boot.img itself is signed but both the boot.img and the kernel.

Or i have seen cases of unsigned boot.img but signed kernel image.

Either way the cookie crumbles if you cant run a custom or modified kernel you won't be able to run most custom roms.

With safestrap and fish the stock boot.img of the device is loaded into memory. The Kernel and ramdisk are uncompressed and the kernel is loaded into ram. At that point the bootloader passes off control of the device to the kernel. Then the kernel executes the init binary in the ramdisk that runs all the init.rc scripts that boot you into android or the recovery.

Now in a case where you have fastboot ( WE Dont ) the device is actually booted into the Little Kernel ( aboot) bootloader. From that state of the boot chain you can # fastboot boot boot.img # and the bootloader will load the kernel and device tree and unpack the ramdisk and do whatever init tells it to.

If we only had fastboot:(

So the idea is to get U-Boot loaded on the device to replace what little kernel does and give us the ability to fastboot boot our own custom boot image. But it will be (bootm) or (tftp boot) not fastboot.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Almighty1:
Interesting and thanks for the info. Am I correct that the boot and recovery partitions are not mounted?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] yes_have_some:
Right on BigCountry! Been keeping an eye on your thread and just wanted to tell you that i think the time and effort you have put into this endeavor is awesome! Many people such as myself are in your corner and am willing to help as much as possible(im limited in knowledge, as i only started this whole root&unlocking deal little over a yr ago) But if you need any help just pm me and ill do what i can to help ?Btw, im on BL v.2 (S2BQL5) samfail 2.5 w safestrap 4.07
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Well I was testing the edl bootloaders in the edl package and got myself a pretty good brick going on.

I need a backup of the beginning of the /dev/block/sda.

dd if=/dev/block/sda of=/sdcard/sdabak.img bs=1024 count=1000

That should be enough.

Sneaky samsung put a hash in the first few disk sectors that are not a part of any partition.

Flashing in edl will erase that data and brick you.

I need the data so i can fix the edl package and unbrick my device.

There is a testpoint to get into edl. But you gotta take the device apart.

I will upload the pic in case someone needs it.

https://ibb.co/RCvWrSC

Photo link

ibb.co/RCvWrSC

Put https:// in front of that. XDA is not handeling the link right.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] pbedard:
Rip bro
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Ph3n0x:
What bootloader are you on that edl recovery in the beginning will get you back to download mode

---------- Post added at 04:44 PM ---------- Previous post was at 04:22 PM ----------

You should be stuck at qdloader 9008 get the proper drivers and use the edl recovery package signed by Samsung in a previous post my discord is ph3n0x if you need help
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] CountKrzysztof:
My partner talked me out of bringing my laptop with me on my Christmas vacation, but if nobody else sends that backup before I get home on Saturday I'll make the backup and send it to you.

I really appreciate all this work you've put in for the Note 8 community!

Cheers, and happy holidays :)
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] dazemc:
You know, I'm not 100% sure but I may have the image you are looking for. Back when I was rooted I was repacking my data manually into the rooted images so that I.... long story short I backed up all my partitions via dd and transfered them to my PC. I just might not have those files still. I'll check when I get home here in an hour or so.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
If you did a full backup of /dev/block/sda then you would have it.

If you did only sda1 sda2 sda3 ect... ect... you wont have it.

But its good to have the backups.

I could still really use a backup of what you have.

I figured out how to get my device fixed.

I did have to use the backups i have for the partitions that odin dont flash.

Some partitions can be zero or cleared out for first boot.

I can figure out what partitions absolutely have to be used from only your device.

I need backups like that so i can diff / compare files.

That way i can determine which ones contain the information like imei and serial.

Those partitions will have to be backed up for any device that needs unbricked.

People need to make these backups before you get bricked.

Once your bricked itll be harder to fix.

If you have backups no problem.

I will post instructions to get the backups soon.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Never........:p

Silly rabbit Snapdragons are UNBRICKABLE!!!! :victory:

I have fully unbricked my device now.

First you have to boot into EDL Mode.

Flash the edl recovery rom in edl mode.

Boot directly to download mode after the edl flash.

Flash in odin the full stock firmware all in one shot.

BL AP CP CSC UMS & PIT file

Check phone bootloader update, reset time, repartition, Nand Erase, Auto reboot

After the flash you have to take the device apart again and boot back into EDL.

In edl run a second flash that restores the device specific partitions.

Re-boot smile be happy. ( If you made a Backup to flash back):laugh:

No backup........I can unbrick you but more will need done to fix everything.:crying:

So man now you can never tell me RIP again.

If i brick it i can fix it no problem.

I would still like some backups from you guys.

So i can make a easier to flash edl rom for unbricking.

I really need this backup.

dd if=/dev/block/sda of=/sdcard/sdatest.img bs=1024 count=1060

If someone can run that command in terminal.

I need to research files. I might be on to something.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] diabl0w:
[MENTION=7006025]BigCountry907[/MENTION] here you go, thanks for your work
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Xenos7:
Could you make a guide on how to unbrick hard bricked snapdragon if you have a backup of sda?

I have 64 gb .img that I got with dd and if I were to ever hard brick my phone, how can I use that backup to fix it?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] dhart62:
[MENTION=7006025]BigCountry907[/MENTION]

Can you message me. I have tried to message you but it is not working for some reason.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Xenos7:
Oh and I forgot to mention, you said the sdcard is higher boot priority than internal ufs. Is usb OTG higher that internal ufs too? If that's the case, we could load the bootloader off the USB.

And also, I've realized that Exynos Note8 and Snapdragon Note8 don't have the same partitions.

And because Exynos doesn't have EDL (or at least usefull one) the only way to revive it is to flash sda image on USB or sdcard. If USB is checked before the internal storage then it's possible to unbrick them too.

And we could load custom bootloaders from sdcard.

Or because we have "unbrick USB" whenever we mess up, we can just re-flash the device.

Don't know if it would work if you loaded the download mode, and then disconnect the USB to connect it to a computer.

And with your methods, will it not be possible to downgrade the bootloader?

In theory, if we dd entire emmc with "zero" and use EDL or unbrick sdcard/usb to bring it back, we could flash V2 bootloader back from V3?

Or is there some other things I don't know about?

Thus could be an interesting experiment.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Xenos7:
Thanks for the info, really appreciate it!

Guess I will buy a snapdragon phone then.

I mean why couldn't they code a button combination (hold volume button and plug the phone in) to enter into edl mode without taking the phone apart.

Kinda like BIOS on PC, no matter if you erase or completly remove the hard drive, you can repair it, unlike the phones, where not everyone has the tools to take them apart.

Didn't have much luck with Note8, 1 year and still no Lineage OS build, even unstable one. Then I love testing and tampering with the device, so most likely I will get Xiaomi if they still offer to unlock the bootloader by that time.

Thanks again for the info, you're a really smart and generous person.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I mean why couldn't they code a button combination (hold volume button and plug the phone in) to enter into edl mode without taking the phone apart.

They dont want us messing around with it in the first place.

Samsung has done everything they possibly can to make testing on these as hard as possible.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Interceptor777:
Also if you're not going to deep in messing around with it, you can always recover with Odin so even the average modder doesn't need edl mode.

It sucks it's like this, wish Samsung would just not care enough.

Oh well, hopefully the community helps you find a way, good luck mate.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] xRaZeR_FuZioNx:
Yeah, Samsung really made it hard for us.

According to leftover strings in the bootloader, they had a volume combination which they removed (for development purposes, I'm pretty sure):

LOAD:00000000140177FC aEnterEdlModeBy DCB "@ Enter EDL MODE by volumn key at USER BINARY !!",0

Guess they don't want us poking around in there.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] hellomen31:
Hi guys . I have n950u, he has an error: dm-verify fail. Can I recover it via edl? Downloading a full backup from another device?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
First i would flash the combination rom in odin.

Make sure you use the combination for the bootloader that the devices is on.

Then flash the normal odin firmware for the bootloader you are on.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] hellomen31:
Damage to the efs section. Combination rom does not load the device. I can not find the right carrier firmware, carrier: mdl

Bootloader v5.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I would also guess that you have no backup of the efs partition.

I don't know why anyone messes with efs.

Best bet is like i said......Load the combination firmware.

The factory binary combination.

You should be able to boot into it. Hopefully.

I suppose that depends on how trashed the efs partition is.

If you could get the combo to boot then in the combo android system there is a tool to restore the efs from the backup on the device. I'm not sure if there is a combination for V5 bootloader. But if there is it is not carrier specific.

I would advise everyone to backup your device fully.

Especially when it comes to the partitions that dont come with a odin flash.

If you are going to mess with them you have to have a backup.

I could give you the backup of my efs partition but it was on rev 2.

I honestly dont know what other problems you would run into but there would be problems.

Like wrong imei.

Possibly you could flash my efs backup then flash the combo rom then inside the combo restore the efs backup using the tool.

The problem here is that on rev 5 you dont have root.

So other than edl I don't know how you could flash my efs.

And i have rev 4 edl files but i dont know about getting rev 5.

So realistically unless there is a rev 5 combination out and rev 5 edl files your pretty much stuck until they come out.

Even having the files it won't be easy.

You have to take the whole device apart to get the mainboard out.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] hellomen31:
Thanks you. My device has already been disassembled. Switch to edl mode turned out. Already checked, thanks for your article. Can you share your copy of efs? I have the factory binary combination for V5 bootloader.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] plainbum:
I would like to completely back up my phone as you suggest.

Would you consider a thorough, step by step guide on how I could do this?

I am on V1 bootloader. I blocked all updates.

Not sure if that matters .

Thanks!
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] hellomen31:
https://mega.nz/#!stJU2Kxa!T7o3JcU9UoHpQeSDv6qyYkK6ZJqHsEkSxNeo17i7xwA

Binary v5 COMBINATION

FA71_N950USQU5ARG2

Thank you very much!!
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I just wondered what you are using for the firehose.

I have rev 2 edl and rev 4 edl.

I have not seen rev 5 edl yet.

Are the earlier rev edl firehose working on your rev 5?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Here is a new link for the backup files from my device.

The other link was not working.

http://www.mediafire.com/file/pqsrxj3vwdn6kd2/N950U-U2-Backup.zip/file
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] truantAndragogy:
Here is a script I wrote to assist with the backup process. The backup uses 60GB of space and is saved to your SDcard, make sure you have space. The script needs root privileges to run, you can do this by:

su -u root ./{name}.sh

I wrote this while on rev1 but it should work for all revisions.?

#!/bin/bash

IF="/dev/block/"
STORAGE=( `ls /storage` )

for DIR in "${STORAGE[@]}"
do
if [ "$DIR" != "emulated" -o "$DIR" != "self" ]
then
OF="/storage/$DIR/n8recovery/"
break 1
fi
done

TRACKS=( "sda" "sdb" "sdc" "sdd" )
`mkdir $OF`

for PART in "${TRACKS[@]}"
do
`fdisk -l $IF$PART > tmp`
LISTED=(`sed -n '11,111p' tmp | awk 'NF>1{print $NF}'`)
`mkdir $OF$PART`
`sgdisk --backup=$OF$PART/$PART.gpt $IF$PART`
COUNT=0

for TOKEN in "${LISTED[@]}"
do
COUNT=`expr $COUNT + 1`
`dd if=$IF$PART$COUNT of=$OF$PART/$COUNT.$TOKEN.bin`
done

done

`rm tmp`
echo "Complete."
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] truantAndragogy:
If you have yet to backup, my script should automate the process for you.

[MENTION=279061]BC[/MENTION] If I understood your guide correctly, the script should automate the process. Please double check I have not missed any important partitions. Thanks for you work, wishing the best.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] pbedard:
Device is dead and all samsungs never will uave root again!! Thats why i bought the unlocked version
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Eudeferrer:
This is why I bought a Pixel 3Xl. This crap frustrated me so much, I couldn't deal with it. Great phone. Just can't deal with lack of root and locked bootloader. BTW, I have been following this thread with great hope, but yeah, it seems dead now.

Sent from my Pixel 3 XL
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
It's not dead but it's not much closer either.

In order for me to develop u-boot for samsung there is a lot i have to learn.

That's why i bought the Dragonboard 410 and recently a Hikey 970.

They are both development boards, unlocked and all the source code is available.

The only trouble is now I am developing the firmware for thees to test the proof of concept.

The unlocked version of the samsung ???

You mean you bought a equinox.

Unlocked just means the sim is carrier unlocked.

I do agree with you guys that samsung is frustrating.

I plan to put my money into the Hikey 970. It's more powerful than the snapdragon 835 and for $900 I can do a heck of a lot with it. The Hikey 970 itself is only $300 but the board has Mini Pcie Slots and mPcie M.2 M key slot.

So the rest i will be spending is on a NVME SSD and some expansion cards.

All in all I have a device that is 4" square by 1" thick in the case with more power than most laptops and the ability to run AOSP or Linux out of the box.

At some point in time my work may lead to a way of getting in the samsung.

The newer android versions have some major changes including /system as root.

Meaning all the files that normally are part of the boot image are now part of the system image.

Only the Device Tree the Kernel and a init are in the boot now. I believe Android Pie and newer.

My HK970 runs AOSP Android Q .
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Romreactor:
Well I wouldn't give up and consider it dead. Definitely a tough task for couple people, when Samsung employed thousands of men and women to basically engineer systems in place to prevent access to the kernel and bootloader. However, best believe if enough time and effort will be put, eventually you will crack it. Then people like myself and many other will consider you guys true geniouses in the android/samsung community and I have a feeling there will be many opportunities to hijack other devices as well. Regardless from my ongoing read of this thread, it looks like the solution for the Samsung Note 8 is through tampering with the hardware and most likely voiding the **** out of the warranty beyond what root access does. Since these devices are pretty pricey as it is, is unlocking bootloader worth it than using the initial SamFail root that was found last year?