yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
So here's why kexec wont run out of the box.

Loadable Module Support isn't turned on in the kernel.

Loadable kernel modules

All SoC kernels must support loadable kernel modules. As a starting point, the following kernel-config options (or their kernel-version equivalent) have been added to android-base.cfg in all common kernels and must be enabled in all device kernels:

CONFIG_MODULES=y

CONFIG_MODULE_UNLOAD=y

CONFIG_MODVERSIONS=y

Samsung is really starting to errkkk me.

Like it's enough work to build the modules or a custom kernel and get something up and running.

But mann I swear they have disabled every little thing they could.

Like they wanna charge $1000 for a phone and the you can't do a damm thing with it.

I could actually do more with my $35 htc desire 526.

Well its just making me more determined.

If they were smart they would have left something for us to piggyback on.

Then we would be running stuff without fully unlocking the dev.

Now there giving us no choice.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I've been spending the last few days studying all of the shell code used by safestrap. I plan to modify it to run purly off the sdcard with the exception of one file. After that is implemented I believe it might be possible to use U-Boot. Starting up U-Boot within the safestrap enviornment in place of TWRP.

If it works U-Boot has Fastboot and may open up more possibilities. Either case U-Boot can load the Kernel and boot a full system. Since we used safetrap to begin with... all signature and verification's. have been done .

It wasn't the route i planned to begin with but I Think it will be the fastest.

I bought a dragonboard today so I can test everything on it and then port it over.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] MrMike2182:
That's exactly what ticks me off about Samsung, every avenue is pretty much a dead end half of the time they literally did disable every little thing they could! I'm still busy just trying to get twrp to build on this Ubuntu 18 and I probably should have just left it on 14 but I was to interested in seeing how version 18 would run and I can say it's good but now I'm running into all sorts of problems with needing certain older applications and I'm figuring it out as I go but I'm willing to try to help you out as much as I can with the time I have.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Ubuntu

Yea I was a little worried about 18.04.

I run 16.04 currently and haven't had many issues compiling on it in the past.

You seem to be linux friendly so how are your shell code abilities?

Basically I can see 2 ways we might be able to load a whole system and kernel.

Any way you look at it first we have to hijack the boot with safestrap.

After that we need to be able to execute U-Boot or if we could execute a highly modified LK that would be even better. For now I'm trying to memorize the safestrap scripts.

The ANDROID Fish is another way to safestrap the recovery as well.

Between the Fish and SS Scripts I want to write a new script using the best of both worlds.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] MrMike2182:
I've been watching everything you're saying/doing and you're abilities are further than mine but it's still going to take a lot of us with different abilities to get this done! I do know about FISH, U-Boot an LK and I do understand the direction you're going in with that.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] MrMike2182:
Have you seen this before? It's pretty close to our 8998 snapdragon board. I've been reading and looking over quite a bit of stuff for the snapdragon board. Check this out https://git.linaro.org/landing-team...og/?h=release/LA.BR.1.2.7-03810-8x16.0+sdboot and this one when you have some time. https://git.linaro.org/landing-team...t&id=10e40039945f5c1d39b4befe63e4a6817f25891f

Is it possible to modify the ABOOT in order to get FASTBOOT to run instead of odin?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I actually just bought a dragonboard and a 7 inch touchscreen.

I got the uart cable and board so I can hook up a serial console to it.

This way I can test my scripts on the dragonboard (which is unlocked) and be able to run adb plus have the console so I can see what's going on.

The 820 software itself is compatible but we can't flash it because it's not signed by Samsung.

Still the tools and processes and documentation all help. If we can find a way to load aboot ( Little Kernel) from the hijacked environment then we would have the equivalent of unlocked.

Otherwise I think it's a higher possibilitie to load u boot from the hijacked environment. U boot can load the kernel and OS.

There is a version of U-boot they use on the dragonboard. They have a well documented process of generating the u boot image.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BotsOne:
Hey [MENTION=7006025]BigCountry907[/MENTION] I was on the team that created SamPwn alongside [MENTION=3812611]elliwigy[/MENTION] and might be able to help. I'm on the newest bootloader though, and a little bit rusty (haven't messed with it since we released SamPwn). I've explored EDL mode, Kexec, different CVS's, and a lot of other stuff. If not anything else, I might be helpful in letting you know which vectors we explored and where we got with them.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] elliwigy:
sup bots! long time no chat! i have a few things ive tried but mostly working on n960u and t837v currently..

i did root the tab s3 but never released it.. not sure if it or a similar method would work on n8 on latest rev but hit me up on the chats if u want n we can throw some ideas at eachother..

our good friend from china showed me screens of his buddy rooted on s9+ combo.. he doesnt kno how tho but i have been going that route and got some theories im working on
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Thank you for offering to help.

Darn that u5 bootloaders.

Why won't the samfail method work on the U5.

Does the combination / service Rom allow a modified system image?

If you can use a modified system image we could try something.

One of 2 things would have to happen.

We would need root or use chrot or prot to write the safestrap script to the e2fsck in /system/bin.

Any shell script you name e2fsck and copy to /system/bin will run as root without su upon early boot.

Of course it better fix e2fsck so it runs as normal just like safestrap.

Otherwise still providing you can run modified system.

I could patch the recovery keys so we can flash a zip signed by our own keys.

Then you just pre-root the system image and flash it through recovery.

Normally to patch the recovery I would unpack the ramdisk and replace the /res/keys with my key but then recovery will fail signing.

However we can do the above and hexdump both recovery then get a diff of the files to locate the Keystring then open the recovery in hex editor and edit the Keystring in hex.

The only possible problem is that since the key is in the RAMDISK and the ramdisk is compressed hopefully the compression don't screw things up.

Yes the recovery is signed but the bytes we need to change are a Keystring always the same length. It is expected to be there. So hopefully it'll pass.

If the recovery is hashed byte for byte it could fail. For some reason I think it'll pass.

Far as your experience with the N950U.

I'm interested to know what your team tried to do with the edl bootloaders.

They seem much more stockish and less Samsung modified. So I wonder if the secure boot settings are more stockish and rely on Devinfo partition.

Thinking like putting together a combination Rom with that set of bootloaders. The GPT is quite different and would require some modification. But the GPT itself says much because the .pit partition table is not a part of it like the other rooms.

In the beginning of the /dev/block/sda there is a hidden partition between the end of the GPT table and the beginning of XBL. If you look you will find the .pit in there.

So normal and the combination rooms use the first 8 disk sectors were as the EDL uses only the First 6.

Lastly.

What are the best boxes. (Octoplus) (zx3) some other. I plan to buy one ir more. I have had tools in the past that come with access to firmware that's not publicly available. It's worth having the tools for that alone.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] butchieboy:
I for one appreciate the work all of you are putting in.

NOTE 9
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Romreactor:
I still have my Note 8 on v2.5 and my friend on V1 bootloader. This is a very exciting thread and also enlightning. I appreciate the effort you guys are putting here because even for someone like me who has almost 0 experience in cracking smartphones, I am learning alot by reading along. Also there's a lot that sounds like foreign language but is still fun to try and figure out by rereading your guys posts. Best of luck in getting this done. At this rate I have high confidence that you guys will figure something out and the community for Note 8 development will go through the roof for Snapdragon users.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] DroidisLINUX:
Good to see people still working on this, got my note on v2 still, I haven't done any coding in while because I was not setup for it since a move, just bought a house, but way back when eris came out and bionic came out I was doing things. Next few weeks I will get my setup back and going and hope to be of some use then. I do work alot but definitely think that loading on the sdcard rom slot should be possible even with out a modified kexe if we use both safestrap to load the rom slit and fish to kill the boot process before. This is kind of a circle Because we can't load fish until after safestrap, but we need fish to be able to boot a safestrap rom I think,your going to need to rebuild safestrap for note 8. I have faith.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Fish and safestrap are very similar.

They both hijack the boot in pretty much the same way.

Safestrap has code that wires what slot to boot.

Essentially I'm going through both safestrap and fish and re-writing a lot of code to use it a bit differently.

One of the things will be booting some partitions off of the sdcard.

At this point even severly locked down devices will have a chance as long as you can get the e2fsck file swapped out in /system for the hijack.

I'm going to call it Hot-Boot.

Basically it will re-boot the boot from booted state. Hence Hot-Boot.

Due to the level of control we have using this method everything should work out well.

Hot-Boot utilizes the e2fsck.bin that in executed even before anything in su.d

Everything executes as ROOT so other than getting the e2fsck.bin replaced by the Hot-Boot (e2fsck.sh) in the device /system root isn't even needed.

Hot-Boot will load a ramdisk and run the init binary to run TWRP Recovery.

A similar process will be used to Hot-Boot the device.

Hot-Boot will take over the boot and shutdown all processes.

The root filesystem will be replaced by the Hot-Boot filesystem.

The Hot-Boot filesystem will launch U-Boot and not the init.bin.

U-Boot will then Load a Kernel and the rest of the initrd for a custom android system.

Provided I don't have any trouble executing U-Boot this should all work smoothly.

All customized stuffs will be loaded from the sdcard partitions. So other than the 1 file nothing on the emmc / UFS will need changed.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
I have not flashed the full edl package but i have flashed single partitions so the firehose and edl indeed work for V2. The edl rom is only the bootloaders so it will currently only boot into Download Mode.

Far as running a full rom with the edl bootloaders......That is one Idea I have. But we would have to use the EDL GPT. And basically build the AOSP to run with it.

Far as the recovery goes I can patch the keys in the recovery so you can sideload any update.zip signed with the keypair. If the U5 combination Rom allows a modified /system the recovery could be a way to flash it. I'm unsure why samfail don't work on Rev 5.

If it is because odin flashing the system don't work then the recovery trick might work.

Far as communication im on Freenode in the carbonfusion channel alot.

But thats steadfasterx channel for FISH.

If you want to set up a channel on freenode we can use that.

Currently I'm working on writing my Hot-Boot Script.

If I can get U-Boot to fire I believe we will have some type of fastboot.

U-Boot apparently has a form of fastboot.

If we can get fastboot up then we can fastboot boot Little Kernel and actually Hot-Boot LK.

In other words we could port some thing similar to efidroid.

This is a definite possibility.

If there exist or if someone could compile a binary executable that can load Little Kernel that is all we need. We would use that binary to Hot-Boot a unlocked version of Little Kernel from the safestrap / fish hijacked enviornment.

Similarly I think U-Boot will be able to load from the hijack. But it could require some type of binary to load it as well.

First I have to get all the Hot-Boot code written. :eek:
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] pbedard:
Bump
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
No worries.

I have finished researching U-Boot.

I'm positive we can get this working. And with U-Boot we can load custom Kernels / Custom Aboot / Custom System you get the idea.

I am currently re-working the safestrap and fish hijacks. I'm writing the Hot-Boot scripts using some of the techniques applied in both of those hijacks.

In the end the Hot-Boot Hijack will simply load the U-Boot.bin rather than executing the init.

I have had a limited amount of time to work on this and since im working solo it only goes so fast.

At any rate there is no doubt in my mind that I can get this working.

Realistically we might be looking around christmas time. Could be sooner but theres a ton of work to do.

On a positive note the Hot-Boot Hijack will be fairly portable. Meaning it will work with any device that normally is capable of running safestrap.

Root isn't even really required. Everything runs as root on bootup from the e2fsck trick.

I call it a Trick because during normal bootup e2fsck is automatically executed as a part of the normal boot process.

What we are doing is renaming /system/bin/e2fsck to /system/bin/e2fsck.bin

Then we are taking our System Shell Script and naming it e2fsck.

So on boot up when e2fsck is called it is running our script. Similar to the init.d provided by supersu.

the only problem i see is that with DM-Verity like on the note 9 we need to at a minimum be able to call a shell script with the e2fsck.

Might not be able to edit e2fsck unless something like samfail allows to run a modified system.

There is always a way though. That i am sure. Hopefully after x mas i can save the money to get a note 9.

In a nutshell all is well. I am positive this is going to work for the * series of samsung devices.

AS said its a matter of time to write the code build U-Boot and get it all debugged.

:cowboy::cowboy:
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] j3ffm1ll:
So I am guessing that it is still not possible on the newer bootloaders?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Actually I've not got an answer yet as to why samfail won't work.

Is it that the Odin cannot write the rooted system the way it works with older bootloaders.

Or is it that the boot image in the combination firmware will not allow permissive selinux and or a modified system image because of dm-verity.

Each of those questions answers a different problem to solve.

I believe we can use the EDL firehose to write a modified system. So we can pre root the system image and install the hotboot scripts then flash the image to the device in EDL mode.

I know antiroolback means you can't flash the bootloaders but that doesn't mean that the firehose won't work.

That needs to be tested. I'm also pretty sure I can patch the recovery to let us flash images.

Now if a custom system cannot be run then that's a different story.

So maybe the samfail team can tell us what's not working.

Flashing the system with edl would require the system.img to be split into sparse chunks and you need the patch zeros xml but it's easy enough to do.

The other option could be hex patching the e2fsck file to call safestrap or hotboot from a sdcard partition. All depends on how touchy the dm-verity is. In E2fsck it would only take one line of code to start the process.

Beyond that if all else fail then possibly we can build the bootable sdcard. Either approach the system data cache boot and safestrap can all be on a SD card and boot from the and never touch the UFS.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] JohnKCG:
Well, I recently bought an snapdragon note 8 because I always liked snapdragon more than exynoss, because in past Mali wasn't as good as adreno, that and custom rom potential, after reading that the USA note was locked down I thought I burned cash and well, I like to modify the hell out of my devices, that is in fact why I stick with android rather than Ios, I must say thank you Big Country, you are doing this not for cash, not for fame, but because you just want to help people like me learn this kind of programming and boost custom rom like world for a device as competent as the note 8, thanks also to safestrap and fish team, from what I read your efforts are also making this possible, sorry for my bad English by the way
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] SomeGuy2008:
Just came across this thread. My vzw note 8 has been sitting at stock N950USQU1AQH7 security patch level 8/1/17 since I got phone in hopes that a bootloader unlock would eventually come. I used package disabler (I think thats what its called) to disable automatic system updates. If im reading this correct, this is still very much a WIP and a method to unlock the bootloader and use custom roms (such as LOS) will likely be an option at some point? From my reading it will likely not be a simple process to get a stock n8 to have an unlocked bootloader using this method?

Thanks for all your hard work BigCountry907, Looks like you have been and are continuing to put a lot of time and effort into this!

~SG
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Jhfreeze:
Wow, read most of this thread and am very hopeful for your efforts and everything you've found so far. Your doing some great work here I wish I had the coding skills to help you. I'll be following your thread and will help if there's any way I can. I already got the note 9 N960F/DS and giving the TMO N8 N950U to the wife rooted BLv3 on Chimera...like she even cares, but it'll be available for testing any final build your able to put together.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] chappatti:
I have a U1 bootloader. I have purposely rooted and kept it at U1. If you need any testing please let me know.

Great effort by you guys !!
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] vman00:
U1 Rooted

I have U1 rooted also. I'm too n00b to figure it out what most of all this means, but would like to help.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] taysandman:
High level indeed. Excited about your enthusiasm and potential.

My linux...I’m of no help…useless…

Unless

... you point me in the direction of a donation page. Unfortunately it won't be 200k, but perhaps others would like to join in too.

Damn Silicon Nazis...Together we can end this oppression.

Remember that all through history, there have been tyrants and murderers, and for a time, they seem invincible. But in the end, they always fall. Always.” ~ Gandi :)
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] Aumaan:
Hoping something arises from this. Was debating upgrading to Oreo before this thread started. Anything new happening?
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] dillonorden:
I have a 950u tht im willing to test drive things if needed
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] JohnKCG:
Looks like you are slowly getting to make things working, I recently received my note 8, thankfully it has the very first u1 bootloader and is the US unlocked one, having an S5 on oreo and a tab s2 on pie, I can easily stay on nougat until Android pie lands on note 8, which I estimate is around may or even further, if you need testers just shout it, am pretty sure that a lot of people here who aren't on your level of knowledge (just like me) want to contribute to your work on any possible way, thanks a ton for your hard work and let's be positive that we are unlocking the note 8
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] iunlock:
Excellent breakdown. Thank you for that. One of the finest pieces I've read on xda. Bravo.
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] dazemc:
I know my way around BASH quite well if you need help in that department. I can set up a build environment pretty easily as well....
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] dazemc:
Also, thank you for introducing me to TFTP. Without doing much more searching this sounds very similar to netboot.

EDIT: It is a function of netboot ?*♂️
[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Thank you very much for offering to help.

The inner workings of Safestrap is actually a bash script.

The factory e2fsck file in /system/bin is renamed to e2fsck.bin and the shell script is named e2fsck.

When the device boots it automatically runs e2fsck and that's how everything starts.

So if you unpack the safestrap apk or just use the .zip you can go through the safestrap script and see what it is doing.

It is easily accomplished to run your own init or mount and load /system /userdata /cache from anywhere. For example a sd card.

There seems to be relations between netboot , tftpboot, etc.

The boot over tftp using U-Boot is a part of U-boot.

That fact is something we will need to overcome because in a normal world the Target Device is booted up into the U-Boot shell, the TFTP server is sending the file to load and the u-boot shell is a part of the transaction.

I need to get further into u-boot testing to know more of whats happening behind the scenes.

I am sure in most situations the Target device is booted into the U-Boot shell.

How the server / target functions are handled will be the key factor of this working.

If the Kernel or U-Boot.bin loading is done on the server side by server side binaries or if the actual load is done by the u-boot binary on the Client - Target side.

Fortunately this is all open source. I am thinking to get full functionality we are going to have to take the U-boot source and compile the loading function into a standalone binary that can be executed by the e2fsck script.

The end product would be nice to have this ability anyway then it would be possible to load U-Boot without using TFTP.

Normally U-boot.img replaces the boot.img in the boot partition. U-Boot.img is loaded the same as normal boot.img because Little Kernel can't tell the difference between them. U-Boot.img is a standard boot.img.

Our problem is that Little Kernel has already handed off control to the Linux Kernel.

We need a way of loading the U-Boot.bin to SRAM and pass control to it from the Linux Kernel.

So basically were taking a step backward.

After I get more testing done I will have a better Idea of what needs to happen.

But i'm pretty positive we are going to need a standalone binary similar to the U-Boot X-loder or SPL with the difference being that the loader must be able to load the U-Boot.bin from Kernelspace.

Got any bash script that can load data to the ram and start the execution?