[Samsung Galaxy J7 Guides, News, & Discussion] Delgoth:
-- UPDATE #1 (11/05/18) added

So I've got myself a Tracfone Variant of the Samsung J7, The "Galaxy J7 Sky Pro" [SM-S727VL] CDMA. As far as I can tell, this variant is sold on both the Tracfone and StraightTalk carriers, and it seems to just run a slightly modified build based off of the Official Verizon Firmware. The build fingerprint lists this device as "J7POPQLTEVZW", or an LTE Verizon Qualcomm J7 Pop. Yes, even Google refers to the device as a J7 Pop on official firmware.

I've had the phone for about two weeks now and I'm ready to begin tinkering again. I have the current official firmware with Carrier & Home CSC files. I also have the Binary 3 and Binary 4 Combination Firmware. I am awaiting download of an Official Stock Bootloader Revision 3 ROM and a set of Official VZW ROMs. I would pay someone for a real engineering firmware build. But I have the the carrier unlocked modems (still CDMA Only I hear) that are ODIN Flashable if anyone needs them. in my past experiences with Combination Firmware their modems are normally nor carrier locked.

Just bear with me on the longwinded-ness of this post. I want to know more about this device just as I've seen many others post already. I'm making this thread because, while I'm not the foremost expert on newer Samsung Firmware or even Android in general, I do know a bit about a lot of different topics spanning all of Android. I just need a little help compiling the command line tools I need. Because we are going to have to use older sources to compile the tools. Please message me if you have Linux experience. I feel like I can do this, but I will need a Linux Person on my side. Get at me bro.

***

So now I will breakdown into my Analysis and post my insights into Rooting this decently awesome (and cheaper) Android. All I know is, deep down my intuition is telling me this device is perfectly rootable, just using a round-a-bout method. I can see all the steps, they just haven't aligned yet, and I don't know the nitty gritty configuration details of CF's SuperSU/pHH's SuperUser.

At this point, it all comes down to setting the correct SELinux Contexts on the SU related files we install manually, and then extending ADB Root to the Launcher. Root currently is basically at the same point I got to with the AT&T Note 5. I have successfully manually installed & configured SuperSU from adb shell only once, and it was by accident on a Note5 w/5.1 combination installed. It seems like the 6.0 based factory binaries no longer include ADB Root in the kernel like KK and LP.

LINKS TO RESOURCES:

https://drive.google.com/open?id=1eP1FK9Jw08sSVwf4X-i1P58-eDHI04LR

***

(1.) There is a major difference right off the top that can be seen in the two carriers. StraightTalk variants are stuck on the build 4ARF2 MM 6.0.1 build. This is only if you've bought the device brand new from straight talk. ST I've heard will not release the 7.0 Nougat build of 4ARF2. Straight Talk doesn't do it's own development. The normal Tracfone variant however, does have a 7.0 Nougat build of 4ARF2, the newest firmware thus far. As far as I am aware at this time, if you can find the ODIN Flashable 7.0 Nougat Firmware for the S727VL, it will still flash onto a StraightTalk variant. ST just will not do it themselves.

But the current official firmware, S727UDS4ARF2 should come in a 6.0.1 form from StraightTalk OTA's, and a 7.0 form from Tracfone OTA's. But since both firmware are made for the SM-S727VL they should still flash. This might also be a path towards decrypting the test-keys the Kernel is signed with.

(2.) Normally, Combination Firmware is from a previous Android Version. Over the last few years of tinkering with Samsung devices, one thing I've always noticed, is that the combination firmware for a given bootloader revision is normally a version behind. Like on the Verizon Galaxy S6 Edge, the Revision 4 Combination Firmware is based on Lollipop 5.0 while the official builds are based on 6.0.1. Or if the device has official firmware that is 7.0 for that bootloader revision, the combination firmware will be based on 6.0.1. My point being, combination and official builds are normally not on the same Android version. They do this I think because the version change forces a full DM-Verity check with new signatures. The combination firmware still works because the "aboot" is legal for the bootloader revision is still validly signed. That's why combination firmware always comes as "1A", "3A", "4A", etc instead of "2D" or "4C". The number is the bootloader revision and the letter after is the ABOOT revision. The last 3 digits of the build ID being the date it was built. With the StraightTalk S727VL however, the revision 4 factory binary UDU4ARF1 is actually based on

the same

MMB29M Android 6.0.1 source as the official UDS4ARF2 MMB29M 6.0.1 release. I haven't seen this happen before and I know it means it will open a door or two for us. Especially considering we have both a Carrier and HOME CSC file for the firmware.

(3.) The Combination Firmware comes with a Permissive SELinux Kernel. Yet unlike most other Factory Binaries I've dealt until now, the Revision 4 Combination Firmware does not include a kernel with adb root. This must be one of the caveats of a MM based Factory Binary. All of the LP and older Combo's I've worked with had a Permissive Kernel with ADB Root, this one only has Permissive SELinux.

The Factory Binary does include a Permissive SELinux Kernel that is flashable/bootable over top of the the official stock 4ARF2 build.

So the official stock S727UDS4ARF2 firmware can be booted in SELinux Permissive mode, which means we should be able to get root somehow, that's usually a deciding factor at the end stage. Our problem with the Note5 was that the Binary 4 Combination was 5.1 while the official revision 4 builds were 6.0.1, so the kernels were all together from different versions of android. That isn't the case at all with the J7 Sky Pro.

(4.) Be careful flashing the Combination Firmware. It could mess up your SD Card. I'm not sure if it was because of the options I was testing in ODIN while flashing a couple times and my SD got repartitioned as well, or if flashing the combo firmware just shorted my SD. Either way, after flashing the combination and then back to stock, my device no longer reads my 64GB SD Card. It didn't read in the factory binary either. I may have to just repartition it for the card to work. But looking at the DiskInfo at the bottom, it looks like my External and Internal SD Cards have been combined maybe.

(5.) The Revision 4 Factory Binary ships with the 4ARF2 baseband, which is unusual as well. Normally a combination firmware will ship with the same build of the CP as the AP. But when I did a NAND Erase All & a Re-Partition in ODIN the Combination firmware still showed me having the 4ARF2 modem installed. But I use Straight Talk so my modem should already be carrier unlocked for CDMA use. Normally combination firmware carry the carrier unlocked modem for that bootloader revision.

*****

*****

*****

This is where I'm at currently. I hope to have some help tackling this. I'll try looking into this some more yes, but I haven't had this long and this is how far I've gotten in ~1.5 - 2 weeks.

ODIN Results flashing 4ARF1 Combination Firmware

T-Flash Total Sector 124735488

Download Mode - WonderShare MobileGo identifies the device as MSM8953

Flash Lock option failed to start flashing because ODIN didn't receive a response from the device.

GPT Layout Information via DiskInfo

--------------------------
Internal Storage (MMC)
--------------------------
* sbl1 [mmcblk0p1] Not mounted
Total space: 512 KB
* sbl1bak [mmcblk0p2] Not mounted
Total space: 512 KB
* ddr [mmcblk0p3] Not mounted
Total space: 32 KB
* limits [mmcblk0p4] Not mounted
Total space: 32 KB
* aboot [mmcblk0p5] Not mounted
Total space: 2 MB
* rpm [mmcblk0p6] Not mounted
Total space: 512 KB
* tz [mmcblk0p7] Not mounted
Total space: 2 MB
* hyp [mmcblk0p8] Not mounted
Total space: 512 KB
* devcfg [mmcblk0p9] Not mounted
Total space: 256 KB
* fsg [mmcblk0p10] Not mounted
Total space: 3 MB
* sec [mmcblk0p11] Not mounted
Total space: 16 KB
* keymaster [mmcblk0p12] Not mounted
Total space: 256 KB
* cmnlib [mmcblk0p13] Not mounted
Total space: 256 KB
* cmnlib64 [mmcblk0p14] Not mounted
Total space: 256 KB
* lksecapp [mmcblk0p15] Not mounted
Total space: 512 KB
* apdp [mmcblk0p16] Not mounted
Total space: 256 KB
* mdsap [mmcblk0p17] Not mounted
Total space: 256 KB
* pad [mmcblk0p18] Not mounted
Total space: 944 KB
* modemst1 [mmcblk0p19] Not mounted
Total space: 3 MB
* modemst2 [mmcblk0p20] Not mounted
Total space: 3 MB
* param [mmcblk0p21] Not mounted
Total space: 10 MB
* efs [mmcblk0p22] (/efs) [ext4]
Used: 5.1 MB, Free: 8.9 MB, Total space: 14 MB
* boot [mmcblk0p23] Not mounted
Total space: 32 MB
* recovery [mmcblk0p24] Not mounted
Total space: 32 MB
* bota [mmcblk0p25] Not mounted
Total space: 7 MB
* fota [mmcblk0p26] Not mounted
Total space: 5 MB
* backup [mmcblk0p27] Not mounted
Total space: 6 MB
* fsc [mmcblk0p28] Not mounted
Total space: 3 MB
* ssd [mmcblk0p29] Not mounted
Total space: 8 KB
* persist [mmcblk0p30] (/persist) [ext4]
Used: 5.3 MB, Free: 26.7 MB, Total space: 32 MB
* persistent [mmcblk0p31] Not mounted
Total space: 1 MB
* steady [mmcblk0p32] Not mounted
Total space: 1 MB
* keystore [mmcblk0p33] Not mounted
Total space: 512 KB
* config [mmcblk0p34] Not mounted
Total space: 32 KB
* mota [mmcblk0p35] Not mounted
Total space: 512 KB
* dpo [mmcblk0p36] Not mounted
Total space: 256 KB
* mdtp [mmcblk0p37] Not mounted
Total space: 64 KB
* dip [mmcblk0p38] Not mounted
Total space: 1 MB
* oem [mmcblk0p39] Not mounted
Total space: 64 KB
* mcfg [mmcblk0p40] Not mounted
Total space: 4 MB
* dsp [mmcblk0p41] (/dsp) [ext4]
Used: 9.5 MB, Free: 6.5 MB, Total space: 16 MB
* modem [mmcblk0p42] (/firmware-modem) [vfat]
Used: 63.9 MB, Free: 27.6 MB, Total space: 91.6 MB
* apnhlos [mmcblk0p43] (/firmware) [vfat]
Used: 23.3 MB, Free: 60.7 MB, Total space: 84 MB
* reserved2 [mmcblk0p44] Not mounted
Total space: 1 MB
* System [mmcblk0p45] (/system) [ext4]
Used: 3.1 GB, Free: 464 MB, Total space: 3.5 GB
* Cache [mmcblk0p46] (/cache) [ext4]
Used: 31.2 MB, Free: 568 MB, Total space: 600 MB
* carrier [mmcblk0p47] (/carrier) [ext4]
Used: 5.6 MB, Free: 39.4 MB, Total space: 45 MB
* Data (userdata) [mmcblk0p48] (/data) [ext4]
Used: 3.9 GB, Free: 6.3 GB, Total space: 10.2 GB
* mmcblk0rpmb [mmcblk0rpmb] Not mounted
Total space: 4 MB
--------------------------
Internal Storage
--------------------------
* vnswap0 [vnswap0] Not mounted
Total space: 1 GB
--------------------------
SD Card
--------------------------
* sbl1 [mmcblk1p1] Not mounted
Total space: 512 KB
* sbl1bak [mmcblk1p2] Not mounted
Total space: 512 KB
* ddr [mmcblk1p3] Not mounted
Total space: 32 KB
* limits [mmcblk1p4] Not mounted
Total space: 32 KB
* aboot [mmcblk1p5] Not mounted
Total space: 2 MB
* rpm [mmcblk1p6] Not mounted
Total space: 512 KB
* tz [mmcblk1p7] Not mounted
Total space: 2 MB
* hyp [mmcblk1p8] Not mounted
Total space: 512 KB
* devcfg [mmcblk1p9] Not mounted
Total space: 256 KB
* fsg [mmcblk1p10] Not mounted
Total space: 3 MB
* sec [mmcblk1p11] Not mounted
Total space: 16 KB
* keymaster [mmcblk1p12] Not mounted
Total space: 256 KB
* cmnlib [mmcblk1p13] Not mounted
Total space: 256 KB
* cmnlib64 [mmcblk1p14] Not mounted
Total space: 256 KB
* lksecapp [mmcblk1p15] Not mounted
Total space: 512 KB
* apdp [mmcblk1p16] Not mounted
Total space: 256 KB
* mdsap [mmcblk1p17] Not mounted
Total space: 256 KB
* pad [mmcblk1p18] Not mounted
Total space: 944 KB
* modemst1 [mmcblk1p19] Not mounted
Total space: 3 MB
* modemst2 [mmcblk1p20] Not mounted
Total space: 3 MB
* param [mmcblk1p21] Not mounted
Total space: 10 MB
* efs [mmcblk1p22] Not mounted
Total space: 14 MB
* boot [mmcblk1p23] Not mounted
Total space: 32 MB
* recovery [mmcblk1p24] Not mounted
Total space: 32 MB
* bota [mmcblk1p25] Not mounted
Total space: 7 MB
* fota [mmcblk1p26] Not mounted
Total space: 5 MB
* backup [mmcblk1p27] Not mounted
Total space: 6 MB
* fsc [mmcblk1p28] Not mounted
Total space: 3 MB
* ssd [mmcblk1p29] Not mounted
Total space: 8 KB
* persist [mmcblk1p30] Not mounted
Total space: 32 MB
* persistent [mmcblk1p31] Not mounted
Total space: 1 MB
* steady [mmcblk1p32] Not mounted
Total space: 1 MB
* keystore [mmcblk1p33] Not mounted
Total space: 512 KB
* config [mmcblk1p34] Not mounted
Total space: 32 KB
* mota [mmcblk1p35] Not mounted
Total space: 512 KB
* dpo [mmcblk1p36] Not mounted
Total space: 256 KB
* mdtp [mmcblk1p37] Not mounted
Total space: 64 KB
* dip [mmcblk1p38] Not mounted
Total space: 1 MB
* oem [mmcblk1p39] Not mounted
Total space: 64 KB
* mcfg [mmcblk1p40] Not mounted
Total space: 4 MB
* dsp [mmcblk1p41] Not mounted
Total space: 16 MB
* modem [mmcblk1p42] Not mounted
Total space: 91.6 MB
* apnhlos [mmcblk1p43] Not mounted
Total space: 24 MB
* reserved2 [mmcblk1p44] Not mounted
Total space: 1 MB
* system [mmcblk1p45] Not mounted
Total space: 3.5 GB
* cache [mmcblk1p46] Not mounted
Total space: 600 MB
* carrier [mmcblk1p47] Not mounted
Total space: 45 MB
* userdata [mmcblk1p48] Not mounted
Total space: 55 GB
--------------------------
Internal Storage
--------------------------
* dm-0 [dm-0] Not mounted
Total space: 10.2 GB
--------------------------
tmpfs mount points
--------------------------
* /dev [tmpfs]
Used: 192 KB, Free: 929 MB, Total space: 929 MB
* /mnt [tmpfs]
Used: 0 B, Free: 929 MB, Total space: 929 MB
* /mnt/secure [tmpfs]
Used: 0 B, Free: 929 MB, Total space: 929 MB
* /mnt/secure/asec [tmpfs]
Total space: unknown
* /storage [tmpfs]
Used: 0 B, Free: 929 MB, Total space: 929 MB
* /storage/self [tmpfs]
Used: 0 B, Free: 929 MB, Total space: 929 MB
--------------------------
Memory
--------------------------
* RAM
Used: 1.4 GB, Free: 388 MB, Total space: 1.8 GB
* Swap
Used: 503 MB, Free: 520 MB, Total space: 1023 MB

**************

**************

UPDATE #1:

So I've unpacked the RAMDISK from the current official build (4ARF2), and the current official factory binary (4ARF1), as well as the official combination build from the last bootloader revision (3ARC1)

My results find that the file, "/verity_key", is the exact same across all the 3 most recent firmware. Like I opened the "verity_key" file in a hex editor, and the binary data for "verity_key" is exactly the same across the board for all 3 builds of the firmware.

THE SAME GOES FOR "/publiccert.pem". Does this mean the signature remains the same for Bootloader Revision 3 and Bootloader Revision 4? Does that mean they've used the same signature throughout their Marshmallow Releases? Doesn't that mean the signature should be easier to find?