[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
Now what im thinking is related to my first ever android hack several years back.

By generating my own .pk8 and .pem keypair I figured out how to dump the publick key into the keyform used to verify the signature of ota zip packages to flash in a stock recovery.

By taking the key dump and replacing it in the recovery /res/keys.

The group of files in the above mentioned zip file is for signing packages and boot and recovery image.

I believe if I can find where the publick half of the keypair for verifying the boot signature I can replace it and sign my boot and recovery with my own keys. The bootloader still verifies the signature but it passes because its verifying my public half of the keypair against a file signed by my keypair.

I might know already where the certificate is. I need to pull out a old tool.

I wrote this shell script years ago for this very purpose. I think its broken slightly. I was working on it and never finished.

But if you know shell code the errors are easy enough to fix.

The setup will work. Its posted here.

https://drive.google.com/file/d/0B8jitdIyh2NtMHo4Q1ZLbFk3aEE/view

There are a couple of threads I wrote about it.

https://androidforums.com/threads/root-rom-recovery-r-d.975147/

Quick Ho to

make a folder in the home dir called auto-key

unzip the file in there

Signing the zip will work with this.

Just use the keys i sent along in the package.

Only thing is if the recovery.img is alot newer you might have to use the new boot tools.

I havent written them in the software yet.

Under the folder boot in auto-key

Put your recovery.img in the boot folder

cd ~/auto-key/boot

type

./mkboot recovery.img new-ramdisk

that will unpack the recovery.

open the new-ramdisk folder

go to /res in the new-ramdisk

there is a file called keys

delete it

go to the the keys folder in auto-key

~./auto-key2/keys/factorykey/res/e-0x3

copy the keys file to the

new-ramdisk/res folder

cd

cd ~/auto-key/boot

type

./mkboot new-ramdisk patched-recovery.img

it will repack the recovery

Then you have to flash patched-recovery.img to the recovery mmcblk of your device.

You will have to use the dd command in adb if you can.

Not sure what type of access you have with the bootloop.

example command may work for you

just make sure that the patched-recovery.img is in the dir that shell is cd to.

then type

adb push patched-recovery.img /storage/sdcard0

or

adb push patched-recovery.img /storage/sdcard1

whichever one is your sd card.

then type

adb shell

su

dd if=/storage/sdcard0/patched-recovery.img of=/dev/block/mmcblk0p?? "make after the p your correct partition for recovery"

To sign files put them in the tosign folder in the auto-key folder

only 1 file ata a time can be in that folder

run akey.sh

select sign files

select option 1 in the sign files menu.

You will find the signed zip in /auto-key/output.

If you need more help let me know

Now Im not saying do all of that. But im saying Im pretty sure I might be able to use this same process to self sign our boot and recovery images. Then we don't need a bootloader unlock.

Our custom boot and recovery will be certified samsung official.

Just a lot to work on now. The sdcard and now the signing project.

Now were starting to have some real fun.