yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
Looking into the software side of this again, I read through several pages back and didn't get a clear answer. Did it matter if there was no line showing RMM/KG state in download mode? I tried on my daily driver as well as on an eng fw test device, neither showing anything about rmm/kg, where it would be is "SYSTEM STATUS: Official". On a 3rd device I see KG state as Prenormal on stock fw.

Reading around for other samsung devices, not showing a line in some cases means that it was disabled. If that is the case, what twrp would be the best to test it out?

Also, I played around with a variable resistor for a few hours but couldn't get the download mode to trigger on the eng fw (didn't try on stock), just ordered a cheap decade box, we'll see if that does anything.

Also also, sys.oem_unlock_allowed is by default 1 on my eng fw? even after reboot sys.oem_unlock_allowed = 1

Also, also, also? What about Wrongzone? I couldn't find it compiled anywhere but I found this which seems to be a poc https://github.com/QuestEscape/exploit/tree/master/CVE-2018-9568_WrongZone

This should work on oreo, the release slides also mentioned it working on pie but I'm not sure this code would. Theoretically all we need to do is compile it?

---Previous Trursday 7:56 PM -- Next Tuesday Jan 19 10:27AM---

So I ran across an app called "Shortcut Master Lite" that automatically finds dialer codes otherwise known as hidden or USSD codes. Got bored and decided to try them all and see what worked on our 767vl. So here is a list of all that I've found so far while testing the "*#code#", "*#code", "#code#" and "##code#" formats. Still to test are the "*#code*#", "*#*#code*#*#" and "*#*#code#*#*" formats as well as any others I can find. This is by no means an exhaustive list, but it has several interesting menus and possibly some codes that other lists dont. Again, these are all personally tested and at least do somthing when entered.

Spoiler content hidden.

What lead me on this path is trying do access the IOTHiddenMenu which according to SML has a KERNELUNLOCK activity, which could be very interesting as well as a SerialMode, SerialPort and TerminalMode. Accessing the full menu would definitely open up a lot of settings to the user, possibly including a way to root.

--- Previous Tuesday Jan 19 10:27AM - Next Friday, Jan 22 ---

Well, I found download mode with the Decade box. Oddly enough it was 304k for me, not 301k. Also, just a resistor doesnt do it, you need to supply power as well. No message of any values being reset or cleared. Shuts down immediately when power is removed. Also kinda finicky, but that could just be my setup.

Edit: Gosh it must be my setup, now it is triggering on 301k and 300k, 304k still seems to be the most reliable tho.
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
So I got a j7 with a binary of 1, theoretically this will allow me to use any exploit made after June 2018.

With this one that makes;

1x binary 1

2x binary 2 (and one motherboard that I may be able to get working again.)

1x binary 4

1x binary 5

If I update one of the binary 2's, I will be able to test software exploits on any firmware released for this phone. (I think? It may go up to bin 7)

If I can figure out direct flashing to EMMC, I may be able to downgrade binary versions.

I got the probe station and built a sd card breakout board for reading the emmc.

There is still the possibility that the soc would mess with flashing on the board, but hopefully I can find which trace/s to cut to make that possible.
[Samsung Galaxy J7 Questions & Answers] eduardvi995:
I read all these pages trying to understand the proccess you guys are going through.

Seems like the only available software-based choice (No JTAG) to root this device is actually get in touch with samsung,trackphone or verizon support and ask for any method available. Some devices got bootloader-unlocked doing this. I've been using this device for a while and it's quite similar to the J7 star ( Tj737), so i thought it's worth to be given another try.

Sadly, i cant afford to get JTAG or buying a specific eng boot file for this phone as someone above said, so i have to rely on trying to port old rooting tools as an additional method.

Those of you who are still interested of getting some development on this device please report.
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
I have a probe station and a hacked up sd card reader to dump the emmc but work picked up and I haven't had time to mess with it unfortunately. Once I get a bit of time and get a workspace set up then I'll try at it again. Once I get that set up, it should allow me to directly place magisk or su where it needs to go, still kinda fuzzy on that whole process.
[Samsung Galaxy J7 Questions & Answers] Nootboot64:
I'm absolutely interested in development, pardon my french but I'm really pissed off about the one official OTA update I got, I'm just hoping there's going to be a bootloader unlock method in my lifetime so I can flash a GSI. Thank you for whatever help you're working on.
[Samsung Galaxy J7 Questions & Answers] lehmancurtis:
Hey I got one stuck on frp. Mine has android 9. Any idea where I could find a combo file?
[Samsung Galaxy J7 Questions & Answers] PimpinAintEasy:
I have a SM-J737R4 on Android 9 that took me over a year to root the device without bootlooping, freezing on boot, or countless other modifying side effects.

Screenshots below

Note:

I also found it odd that the SM-J737R4 returns as Samsung Galaxy J7 Top SM-J737R4

Even www.samfw.com shows as J7 Top

Mine is a J7 Aura with the same model # SM-J737R4. I can't recall ever seeing two model numbers exactly the same, yet from different carriers.
[Samsung Galaxy J7 Questions & Answers] lilredfox92:
Did you ever get the firmware? Or do you have a combo file by chance?
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
Pwoof! Dusty thread.

Heads up to anyone who is still interested, an implementation of CVE-2019-16253 has been made by a developer named K0mraid3. Among the devices that this system shell (not root) works on is our J7 Crown! This is a privilege escalation exploit that grants an adb shell system level access.

While this exploit does not grant root level access on its own, it could be a very valuable tool in escalating further, and it is super easy to use!

Edit:

Oh! I have been doing the exploit wrong. so you are supposed to use version 3.0.02.2 of tts, I have been using 3.0.00.86 which gives a whole slew of different permission groups including 1015(sdcard_rw),1023(media_rw) and 1024(mtp). This version doesn't work on newer devices, but for the device I have it allows ls on root XD

https://drive.google.com/file/d/1WtNFBvicSR4EjK0uZrobLYJBjFA9DjG3/view?usp=drivesdk

Chears
[Samsung Galaxy J7 Questions & Answers] DevanWolf:
Please reupload the file!
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
Updated the link. The extended permissions may just be from the specific device, which is on android 8 with a Sep 1st 2018 security patch. I am open to trying to get root on this device, maybe that could help others.

I also stumbled across CVE-2019-2215 (aka qu1ckr00t) which seems to be a <2019 security patch for kernel r/w and has been used on other devices for temp root. Not sure if I or someone else had mentioned it on this thread yet.

Another vulnerability is SVE-2019-15230, using a uart cable and an ACE in the bootloader to load a custom kernel and get root.
[Samsung Galaxy J7 Questions & Answers] deshaney:
i used magisk to patch the boot.img but no luck rejected during flash. The lineage roms are capable of being flashed from the recovery of a factory binary. they spoof oem signature, if someone knew how to extract that and place it in a custom rom for the j7 crown that might be a viable option.
[Samsung Galaxy J7 Questions & Answers] MissAllieX:
ROOT Samsung Galaxy J7 Crown (SM-S767VL)

I too need to root this same exact device. I've done a ton of research on how to root, unlock the bootloader and even the software to do so. It's SO hard!!! I really really need this device rooted so I can recover text messages and pictures that pertain to a legal matter.. PLEASE HELP ME!!!
[Samsung Galaxy J7 Questions & Answers] soberforlife91:
Any update?
[Samsung Galaxy J7 Questions & Answers] JP Go:
Just wondering if anyone was successful in rooting this phone? I've tried Kingo Root and One Click Root as well as King Root 5.3.7 with Andy running and no luck.
[Samsung Galaxy J7 Questions & Answers] soberforlife91:
I can't even remember everything I've tried. Has anyone successfully enabled fastboot?
[Samsung Galaxy J7 Questions & Answers] the_R00ter:
if i unlock the s767vl (tracfone cdma) which uses verizon towers, can i take it to att? have done some research and it seems that they both support a lot of the same lte bands but i am not sure if there are cdma lte bands and there are gsm lte bands or if they are the same thing. thanks in advance. (i will unlock the phone online and pay like 15 bucks for it.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
There is no such thing as fastboot on Samsung devices, adb works on Samsung, but fastboot does not. Samsung uses tools such as Odin or Smartswitch to flash files, there are a few other tools that can flash Samsung but Odin is the most reliable for flashing custom software.
[Samsung Galaxy J7 Questions & Answers] soberforlife91:
Wow. How did I not know that? Lol. So no fastboot oem unlock? When I'm telling you I have done so many different trying to get anywhere with this phone, its nuts. And I dont have a pc, so mainly right now I've been playing around with terminal emulator and termux, while attempting to use my s4 as a host using otg. BUT all of that has been primarily focused on enabling fastboot, which is moot. I didn't know smartswitch could be used to flash files. Will you please fill me in on that? Thanks.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Smart switch can only be used to flash official firmware or recover corrupted devices or transfer data from one device to another.
[Samsung Galaxy J7 Questions & Answers] soberforlife91:
Well. That sucks. Have you made any progress rooting the phone?
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Nope, just got it yesterday. If the bootloader is locked on this model number, it isn't worth messing with unless we can get something like SafeStrap installed. It will let us use TWRP and custom ROMs on top of our stock system.
[Samsung Galaxy J7 Questions & Answers] soberforlife91:
Once you get to difgen around you'll find so many things that you can only do with root. It's like Samsung is challenging us. Lol.
[Samsung Galaxy J7 Questions & Answers] kcCali:
Okay I'm really uneducated when it comes to root android mobile procedures. I have a galaxy j7 crown straight talk. Can someone please take a little time to explain how I can safely root my device Please & Thank You.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I can tell by what you posted, that you haven't done any searching or reading to find out if this device can be rooted. You are just assuming that it can be rooted and came here to ask for the easy answer and a handout instead of researching about your device.

You need to take the time to read ALL of this thread.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Locked bootloader
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Something like Safestrap is probably the most viable option.
[Samsung Galaxy J7 Questions & Answers] messi2050:
Hello

If this device have a locked bootloader then you can't follow j7 refine method because they seem to have unlocked bootloader so they just patch boot.img to have root
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Not necessarily, the "OEM unlock" setting does not always, itself, unlock the bootloader. Sometimes, it is a setting that puts the device in a state that the bootloader "can" be unlocked via the compatible unlock method, if one exists for the device.

For instance, on a fastboot capable device, one would enable the "OEM unlock" setting, then boot to fastboot mode and issue the correct fastboot commands to unlock bootloader, or, after enabling the setting, one would obtain the necessary information/codes to unlock then visit a specific website to enter the info/codes and maybe use a couple of specific PC programs to unlock.

In a manner of speaking, it can be a kind of cover over the keyhole that allows you to insert the key to unlock the lock, you just need the correct key to release the lock once the cover is removed from the keyhole.

But, you are right, in a sense. Some devices that have this setting are completely unlocked just by toggling this setting, but this does not apply to all devices, in all cases.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
J737U has Exynos 7870

J767VL has Exynos 7880

If there is anything at all that is compatible, it would be something that has the same chipset, Exynos 7880.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I'll try it when I get home, I don't plan on trying to root this device anyway so I have nothing to lose.
[Samsung Galaxy J7 Questions & Answers] stoney_badger:
Can someone please upload a ROM of this build #?? The OTA update soft-bricked my phone and it wont allow me to flash any older versions. I would be eternally grateful!
[Samsung Galaxy J7 Questions & Answers] Droidriven:
It may simply be some of your user data conflicting, have you tried booting to stock recovery and factory reset the device in recovery then wipe cache partition then reboot? If it is user data causing the issue, that should solve it. But, flashing via Odin might actually do a better job than the OTA did.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I haven't noticed a difference, but, I don't have a lot of stuff installed, I keep my daily driver trimmed down to the bare essentials. My battery lasts about 2 days before needing a charge.
[Samsung Galaxy J7 Questions & Answers] bwagner.ash88@gmail.com:
Me tói
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Only works on rooted devices. If you have one of the Stylo 4 models that can be/is rooted, you can try the Safestrap Apk, it may or may not work.

Do a google search for:

"Safestrap Apk"

Once you find the newest valid version of the apk to download, try these instructions:

https://hashofcodes.wordpress.com/downloads/safestrap/

It probably won't work without porting. I think Safestrap for Lollipop is the newest thing I found.

If you want to try porting it, try looking for safestrap in all its forms at github. There should be a lot of code and commits to view and work with. Just be sure to ask the people the work belongs to for permission before modifying or using anything you find, even if not required to ask, it's just common courtesy.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yep, tried it already, that applies to carriers/plans/devices that have a pre-set time limit that triggers the OEM unlock setting to appear after the pre-set time has passed. But I don't think this applies to Straight Talk or any other prepaid MVNO network. It might be that it is only an option for the major network carriers and only on devices that are on a monthly billed plan on their network, but not devices that are on their prepaid plans or any of their subsidiary MVNO networks that have network sharing contracts with the major carriers.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Maybe, but it would probably be somewhat slow. It's basically running an emulator in android to run android, the android running in the "emulator" can be rooted easily and run as root within the "emulator".
[Samsung Galaxy J7 Questions & Answers] jparnold09:
My neighbor has one of these, I used to mess with the Galaxy in the early years starting with the Galaxy S went all the way to the S4 then I got smart and started buying unlocked carrier phones. But something I noticed when rooting these, when they introduced Knox everything changed. It's like Knox locks your phone down too well, on the old phones you had to root the phone without tripping Knox, it essentially hard-bricked the phone if you tripped knox, but there was a way to get around it by flashing a factory version using Odin, I think this problem is kinda the same. So you'd somehow have to flash a factory unlocked boot.img that correlates with the hardware as well... If any of this makes sense.

Also, I think there was an .exe file that I used to root the Alltel cdma S3 that was similar to a one touch program to not trip Knox and get rid of the factory bootloader all in one, I can't tell you what it was called off hand let me see if I can find it.

Pretty sure I still have all these files on my computer in my external hard drive.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Sadly, that isn't an option on this device.
[Samsung Galaxy J7 Questions & Answers] jparnold09:
Read my update on the .exe flashed from adb

---------- Post added at 10:24 AM ---------- Previous post was at 10:10 AM ----------

This is interesting...

https://www.fcc.gov/consumers/guides/tracfone-phone-unlocking-program
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Things have changed significantly since the S3, I highly doubt anything from then will do anything now due to the fact that all of the exploits from then have been patched.

That link discusses carrier/SIM unlock, that isn't the same thing as unlocking bootloader. You can carrier/SIM unlock a device, but still not be able to flash custom recovery/ROMs and root because the bootloader is still locked.
[Samsung Galaxy J7 Questions & Answers] jparnold09:
I was under the impression that they unlocked the factory bootloader when switching SIMs.

So let me explain the issue I'm having with my neighbors phone, she's been hotspot tethering for 3mo on straight talk. Yesterday she left the house, went to the store got back turned on the hotspot and nothing, I wiped the cache through the factory recovery restarted the phone, hotspot, etc. nothing.. the weird thing is that the up/download arrows are still on like normal, internet works on the phone perfect, through the hotspot nothing.

---------- Post added at 10:52 AM ---------- Previous post was at 10:39 AM ----------

Right I get that, I was thinking that maybe seeing the .exe file might make a bit of difference to see what they did to get around the factory bootloader. Has anyone tried hitting build number 7 times, and clicking the OEM unlocking option in the developer options? Or is the crown so locked down that this isn't even a viable option??
[Samsung Galaxy J7 Questions & Answers] jparnold09:
I actually just tested this theory on her phone, no avail, doesn't have an oem unlock option in developer options.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
No, unlocking bootloader is insecure, they don't want that.

As for OEM unlock, it doesn't have that option.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
No, can't change anything in system without root and/or unlocking bootloader. Unless you download then extract your stock firmware to get to the system.img then modify the xml in the stock firmware then recompile and sign the firmware then flash the modified firmware as a whole or just flash the modified system.img. But, our locked bootloader would probably block you from successfully flashing the modified firmware or modified system.img.

Our only options are pretty much:

1) unlock the bootloader(which will never happen)

2) use Safestrap with modified stock ROMs.

3) we get lucky enough that one of the universal rooting apps or PC programs gets updates with new exploits that just happen to work for us.

There is really no point in looking for other options, you are not the first to run in circles looking for a way around a locked Samsung bootloader when there isn't one. You can continue to try but there is more than a 99.99% chance that you won't find anything.
[Samsung Galaxy J7 Questions & Answers] Icedicedbaby:
Man after reading all of this.. ugh. I hate this phone samsung j7 crown
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yeah, mine is 7885 also, I don't know where I got 7880 from.

Then it is "potentially" compatible with 7885 only.
[Samsung Galaxy J7 Questions & Answers] the_R00ter:
Guys! Guys! there is a root available!

---------- Post added at 02:03 PM ---------- Previous post was at 02:03 PM ----------

https://www.youtube.com/watch?v=TC_5E70cv-0
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Lol, Kingroot is always the first thing that is tried on devices that have a locked bootloader.

Do you honestly think that this hasn't been tried many times on this device by others already before now? I take it that you didn't read through this thread, if you had, you would have seen where your suggestion has already been tried on this device.

You'll have to do better than that if you want to help others gain root on this device.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Same here, yay!......not.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yes, my Straight Talk S3 SCH-S968C was a rebranded Verizon S3 SCH-I535. It had a I535 motherboard and components, they all had I535 stamped everywhere.

That's why I have stated more than once in threads for Straight Talk and other TracFone device variants, the Straight Talk version of a device will usually be a rebranded version of the Verizon device, unless sold in an area where there is only Sprint/AT&T/T-Mobile coverage and no Verizon coverage in that area("typically" speaking).

For this reason pretty much any root/mods/customizations/custom development made for a Verizon variant can be used on the equivalent Straight Talk/TracFone variant, provided that neither have locked bootloader to prevent flashing modified software.

Root can be achieved even with locked bootloader if there is a tool that has the right exploit to crack the system partition.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
They are actually bound by law to provide unlocking information/service(for a fee, of course), but, you have to keep your service continuously active on the device for a year, with no down time in between, as in, refill your service before the end date each month if you are on the prepaid service plan. You have to jump through hoops just right, but it can be done.

In reality, when we buy a device, we only own the hardware, the software and services are proprietarily owned and controlled by the manufacturer or carrier. We own the right to own hardware that is capable of using their software and services, nothing more.
[Samsung Galaxy J7 Questions & Answers] BeyondIQ:
This is the phone i have...

I got it into dm+acm+adb and blue screen telling me to push vol- and power which puts me on another light blue screen warning me about Custom Roms... yada yada.... downloading...

But i dont have a custom rom to feed it...

Please... anyone have a suggestion?

I have the Stock Rom 2.2gig USA and a link for China Rom for this exact model.
[Samsung Galaxy J7 Questions & Answers] the_R00ter:
Go for it
[Samsung Galaxy J7 Questions & Answers] extrnoob:
I have found root guys! Through Magisk! Still no unl pop cked bootloader yet, and havent been able to find a twrp or anything like that yet. But I do have all the img I need to keep working on it. Let me know if you guys need the copies of the stock img files or of the whole firmware. I would put links up but I cant do that yet.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
How did you use Magisk with a locked bootloader? Patched boot.img can't be flashed with a locked bootloader and TWRP can't be flashed with a locked bootloader either. What trick did you use to get passed those obstacles?
[Samsung Galaxy J7 Questions & Answers] extrnoob:
I am sorry to tell you guys that's wasn't me. My kid brother caught me sleeping at my desk and I just woke up to this... Again, I am sorry if I got anyone's Hope's up...
[Samsung Galaxy J7 Questions & Answers] Droidriven:
We have J767, that firmware is for J737, probably not compatible.