yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy J7 Questions & Answers] Droidriven:
J737R4 = Exynos 7884

J767VL = Exynos 7885

That's a no-go as far as CPU without being ported. But, as you said, using just the bootloader from J737R4 "might" work. But, in my experience, you want everything exactly perfect when messing with bootloader, the slightest difference or the slightest error will result in a completely hard-bricked, unrecoverable device.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I added to my previous post.
[Samsung Galaxy J7 Questions & Answers] btcalex:
unlock

Hello, does anyone have the firmware to unlock this phone?:confused:
[Samsung Galaxy J7 Questions & Answers] extrnoob:
I managed to pull my build .prop in adb shell last night. I was looking through It and found some VERY interesting lines about oem unlocking. Do you think there is any way for us to use this to unlock the bootloader? I can forward what ever I need to if it would help...

---------- Post added at 05:19 PM ---------- Previous post was at 05:16 PM ----------

I have stock firmware., but I camt postlinls because I am a junior member...
[Samsung Galaxy J7 Questions & Answers] btcalex:
Will this unlock it? It's locked to Tracfone, I would like to use it on Tmobile.
[Samsung Galaxy J7 Questions & Answers] btcalex:
How can I unlock it to be on Verizon then or maybe on Tello?
[Samsung Galaxy J7 Questions & Answers] Droidriven:
The locked bootloader will prevent any changes you make to build.prop from persisting. It will revert back to original when you reboot. The best you could hope for is booting the device into system, connect to adb, then issuing a adb command to change a line/value in build.prop, it might persist until the next boot, then the command would have to be used again after the device boots. And that's IF that even works on your device.
[Samsung Galaxy J7 Questions & Answers] tripdiggler:
Sorry i haven't replied sooner. I've been on a "county vacation". As soon as I get my PC back, I'll dig up that firmware for Y'all. But just so u know, it IS 100% possible!
[Samsung Galaxy J7 Questions & Answers] Droidriven:
What is possible?
[Samsung Galaxy J7 Questions & Answers] Droidriven:
If this:

https://firmwarex.net/samsung-j7-crown-sm-j767vl-combination-file/

Is true, it is an engineering firmware that should be unlocked/unlockable or at least able to modify even with the locked bootloader or even patch the boot.img via Magisk then flash that img.

There was a method like this using the engineering firmware on the Straight Talk S5 (S903VL) to allow flashing a system.img(4.4.2 instead of 6.0.1) from the Verizon S5 then rooting that system as described here:

https://xdaforums.com/showpost.php?p=71714229&postcount=78&nocache=1&z=589502981941085
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Hmmmm, it has the OEM unlock setting, as I suspected. There may be hope. It may be possible to now flash a Verizon J7 TWRP (or a ported version of it if it doesn't work as it is, if one even exists, or another TWRP ported from another similar device)then use TWRP to flash the Magisk.zip then install the Magisk Manager App. Or, it may be possible to extract the boot.img from the engineering firmware file then use Magisk to patch the extracted boot.img then flash that patched boot.img via Odin.

First, since you have OEM unlock enabled(I'll bet that excited you when you saw that we finally had the OEM unlock setting), now, boot into download mode(Odin mode) and take a screenshot then post that screenshot, or post the information that is listed in download mode.

I would try flashing the Verizon J7 TWRP(provided the Verizon J7 is the same chipset as ours and has a TWRP available) via Odin. If it bootloops, you "should" be able to repair it by flashing the engineering firmware or at least a copy of the recovery extracted from the firmware. If TWRP successfully flashes and boots and also boots to system without bootlooping, we're in business because if TWRP can be flashed, it means the patched boot.img can be flashed via Odin or the Magisk.zip can be flashed via TWRP.

I would look up some guides that describe rooting other Samsung devices using their engineering/factory test firmware, I would focus on guides and discussions that describe rooting Samsung devices that have stock Nougat, Oreo and/or Pie engineering firmware.

I would do some researching and discussion with others that have done a similar process on other Samsung devices, there may be other details that need to be dealt with in the process or other parts of the stock image/partitions that need to be modified in order to achieve root safely without causing other unforeseen problems.

Or, maybe the method below can be adapted to work on the ST J7 crown, it might require creating similar files to the ones described that have been adapted for the ST J7 crown.

https://xdaforums.com/galaxy-j7/how-to/root-guide-samsung-galaxy-j7-prime-t4010939

Ask the poster if this can be adapted to our J7 and if so, what is needed. It's only temp root though, I wouldn't use this unless nothing else works.

If this weren't my daily driver, I'd try this from different angles. I'm tempted to go buy another one just to experiment to see if I can get anything to work. I probably will if I can get one for the right price, maybe even one that is busted but still works, it would be fine for testing.

If we get this figured out, we'll put our stuff together and write a proper guide thread for the process and link this thread over to the guide.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Wait, what do you mean no recovery or download mode? Can you still boot into system? Did you do more than flash the firmware to cause this? You haven't tried flashing custom recovery or Magisk yet or tried anything else, have you? If so, it was a bit premature without further research to verify the true state of things.

I can't make out anything in that screenshot.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Ok, but, don't give up on the engineering firmware yet. Engineering firmware don't have the restrictions that typical stock firmware have. It might not allow us to flash things that modify the device, but it does have some doors that are intentionally put in the system to allow developers to make changes. That is the purpose of these types of firmware, without them, developers that work for the manufacturers/carriers to design the software on our devices, wouldn't be able to do their jobs. We have some pinholes in that firmware somewhere that we can take advantage of, we just have to find out what pinholes and where they are.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
This TWRP is probably the closest thing to ours(J700 j7elte Exynos, we have j7topeltetfnvzw), it "might" work as is but I wouldn't try it yet. It might need to be ported first or it might not work at all. The Verizon S3 was d2vzw, my Straight Talk S3 was d2tfnvzw, the Verizon S5 was jfltevzw, the Straight Talk was jfltetfnvzw. See the pattern and similarity in codenames between the Verizon version and Straight Talk version?

https://twrp.me/samsung/samsunggalaxyj7exynos.html
[Samsung Galaxy J7 Questions & Answers] Droidriven:
The point is, a TWRP from one of the other carriers that have a variant with the same chipset, should work on ours. But, at this point, I don't think attempting to flash TWRP is safe. The engineering firmware has the OEM unlock setting, but I think the bootloader may still be locked in some subtle way. Let me think and dig around a little. There are chinks in this armor that can be exploited, even if just minor modifications and only temp root, that can still be used to achieve a few things using root capability.

Edit:

I just found another engineering firmware, U2ARJ1, it is 2 binary .

The other one is U4ASG1, it is 4 binary.

Not sure of the significance of 2 binary vs. 4 binary. Seeing what I can find now. With OEM unlock enabled, we "should" be able to use Magisk to patch the boot.img and flash it, but I think there are a couple of other parts that need to be extracted from the firmware along with the boot.img. I'm attempting to find what other parts might be required.

Another thing that I am starting to wonder is, if you opened your device and it had J737V(SoC Exynos 7884) stamped on everything, how can the J767VL have SoC Exynos 7885 if it has a J737V motherboard? Wouldn't it have Exynos 7884 if that is the SoC that the J737V has? Strange.

No, wait, I'm finding conflicting data, I'm finding specs that say the J737V Aero has Exynos 7885. That means, we should be able to flash the J737V Aero j7topeltevzw TWRP on the J767VL Crown j7topeltetfnvzw since they are both Exynos 7885 and both are j7topelte variants.

I'm looking for the cheapest J767VL I can find for testing. I'm going to try the 2 binary firmware/OEM unlock then flash TWRP. Or, Magisk patched boot.img(and additional files if needed) if TWRP doesn't go as planned, as described here:

http://androidbiits(dot)com/root-st...xy-j7-crown-sm-s767vl-j7topeltetfnvzw-easily/

remove the (dot) and replace it with .
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yeah, it isn't going to, the Verizon BL isn't going to work with our system software or kernel due to improper signatures, the recovery for Verizon will certainly work on the hardware, provided the bootloader allows it to flash to the recovery partition. I really am thinking that the J737V TWRP will work with one of the engineering firmware that I found with the OEM unlock setting enabled. Or at least Magisk patched boot.img. The bootloader should be allowing them to be flashed. With Magisk, it's probably a matter of having the correct recipe of .imgs and files each patched and flashed/installed in a certain order or other conditions.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Slow down bro, you're taking a lot of risks, have patience, we don't want to brick anything. I'm posting ideas but I'm trying to be cautious and check them out before I actually try them.

---------- Post added at 04:22 PM ---------- Previous post was at 04:18 PM ----------

I don't know of any recover flashable update.zips for this device. I can try flashing the engineering firmware then flash an older normal stock build, then let the update system download the OTA then interrupt it somehow then find a way to pull a copy of the downloaded OTA and convert it to a .zip that can be flashed via stock recovery.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I found a U2ARJ1 engineering firmware for Straight Talk last night, I just found a J767VL U2ARI3 firmware for TracFone. No update.zip yet, still looking. Using the reboot bootloader option in recovery isn't helping? You might be able to use the apply update via adb option. It might be possible to modify some of the stock .imgs or files to work via adb update.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I haven't had any luck finding an update .zip, but, you can try finding an update.zip for a similar device, then modify it by replacing the files in it with the corresponding files from the engineering firmware. Then zip it and try flashing it in recovery.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I'm working on devising a method that involves flashing the engineering firmware to enable OEM unlock, then immediately flash TWRP, then convert the 9.0 stock firmware into a TWRP flashable zip to restore to stock via TWRP while keeping the unlocked bootloader from the engineering firmware.

Or

Get the OEM unlock then flash a Magisk patched 9.0 boot.img to at least gain root then flash the other parts of the stock firmware, excluding the bootloader. The boot.img is in the AP file, not the BL file. That is probably why you had issues flashing the 9.0 AP, CP and CSC over the eng BL.

Oh yeah, another trick that might have worked is boot to recovery, select reboot bootloader and as soon as the screen darkens, immediately press and hold volume down+home(but not the power button, the reboot selection already triggered power for you, you just need to complete the sequence with vol down+home), it's the same as pressing all three then letting go of power when it boots.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Not true, I found this:

https://androidforums.com/threads/power-reset-or-unknown-upload-mode.229201/

And this:

https://m.youtube.com/watch?v=IkvBQTzZWhc

I didn't use these to figure it out though, I didn't even do any searching when I was trying to figure it out. I just kept trying different things until I found a solution.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I don't know if that will work or not. At the moment, I have the 737A flashed with eng firmware with OEM unlock enabled, trying to get TWRP installed or a patched boot.img installed. No success yet, when I flash either via Odin, it just hangs at "setup connection" and doesn't do anything else. I've tried normal Odin and the Patched Odin. I'm far from done, I'm trying from as many angles as I can, it might take a couple weeks or a month or more to get it figured out, if it can even be done. I'm not a developer or a coder so I don't know all the tricks or the kinds of specifics that can tell me what I can and can't do.

The engineering firmware has the OEM unlock setting and the kernel has permissive mode enabled, this means that modifications are definitely possible. It is just a question of what to modify and how to modify it.

When I compare the hardware/software that is shown in the engineering firmware, the 767VL and the 737A both show pretty much the same info, they show both having basically the same stuff even though they have different CPU. I read somewhere that the 7885 is a slower version of 7870(or vice versa). Kinda like Intel does with their processors. The model number will be different but it will be the exact same hardware as an existing CPU in that series, they just lower the clock speed. They do this for convenience instead of redesigning the whole CPU.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I'm not sure, I though of that myself. I also tried installing apks but I think the engineering firmware doesn't have a package installer, we might can sideload an installer then install apps via file browser.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I'm getting in touch with some experienced members and developers that I know here. Maybe they'll have some ideas or suggestions.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Well, I've tried installing the engineering firmware, reboot to system, once it boots, power down then immediately back to download mode then flashing a patched engineering firmware, but that fails.

Doing the same thing but trying a patched 8.0 stock firmware flashes but it hangs at the very end at the omr step but never finishes or reboots. It also triggered a secure boot error in the download mode screen on the device.

I've soft-bricked it a few times but keep restoring it.

I've tried using kingroot on PC to attempt rooting the engineering firmware while booted into its system.

I've tried adb pushing files and tried installing apps via sideload but it isn't working. adb and adb shell are fully functional but I don't think it has what it needs for transferring files, it doesn't even show up on PC as a device that can be transferred to/from.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I've been putting time into learning what kinds of system level modifications can be done with engineering firmware. It has the OEM unlock setting enabled and it is in permissive mode, there might be a way to use adb or adb shell to flash modified system or kernel or custom recovery while booted into engineering system. If I can get engineering firmware to allow the 9.0 system.img(modified with su binaries in the system.img) to dd into the system partition while keeping the engineering bootloader, we might be in business. Then it might be a matter of dd-ing of some of the other .img files from the 9.0 firmware to restore full functionality, maybe even dd a TWRP.img to get properly rooted and make nandroid backups. Then it's on to possibly modifying some stock ROMs or even building/porting some custom ROMs from other J7 variants.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I'm starting to think this isn't going to work. Even though the eng firmware has the OEM unlock setting enabled, it still shows the KG state is prenormal, this means it is in the same state as some users that have the OEM setting that greyed out in their system settings. In other words, it shows the setting and the setting can be toggled, but I don't think it is actually doing what it is supposed to do, it is just staying in the prenormal state as if the toggle was never switched.

I've tried different recoveries, some I ported for our device and one that a colleague ported for us, but no go so far. I've tried extracting the boot.img from the eng firmware and flashed it into the 8.0 stock via Odin but that doesn't work. I've tried porting stuff from the eng firmware over to the 8.0 firmware, but it doesn't work. That may be a matter of me not doing it right or it might be a matter of it isn't going to work at all, I don't know. I'm basically feeling my way through. I've never tried cracking a device on my own without a guide that someone else already came up with. There are a lot of things about exploiting vulnerabilities that I just don't have experience with, I'm kinda feeling in the dark.

It does show the system status as custom in the download mode screen and it does show the SELinux policy is set to permissive mode instead of enforcing mode. This might mean that I can try making modifications via adb or adb shell while booted into system, that remains to be seen.

All in all, it is starting to look like a dead end, but I'll keep trying because this is the closest thing to chance we are going to get at customizing this device.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I'm not sure about any of that.

I noticed that when I boot the S767VL to download mode, it says KG State: checking. This means it is not in a prenormal or locked state. This might explain why we don't have the OEM unlock setting. I'm tempted to try flashing TWRP on the S767VL just to see if it means that it is unlocked.

Also, our device might need to flash a Magisk patched recovery instead of a Magisk patched boot. Magisk installs in recovery partition on some devices.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
https://drive.google.com/file/d/1z6CZ0iXCAI5HPICsQhfcsQOJyK18y7CM/view

I noticed that in your screenshot of download mode, it isn't showing the KG state at all.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yes, if the recovery flashes, you'll need to flash a ROM. That is the next bridge to cross.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
No, already tried that.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
sboot.bin and cm.bin are in the BL file in the stock firmware. For the eng firmware, just extract the while file and you'll see all the .bin and .img files in one folder.

---------- Post added at 04:35 PM ---------- Previous post was at 04:32 PM ----------

I haven't been able to get adb to install apps in the eng firmware.

---------- Post added at 04:37 PM ---------- Previous post was at 04:35 PM ----------

Yes, trying to use anything gets fc. I don't know what is missing in the eng firmware that is causing that, they didn't intend on it having anything extra installed/added, so they didnt build it with the capability to do so.

What we need is a eng root boot.eng, it allows adb to be used with root access, they are also signed by Samsung, it can be flashed in the stock firmware with no issues, the engineering firmware won't be needed. The eng root boot.img has to be for our specific model number and has to have the same build/binary as the 9.0 stock firmware. But, I think they have to be bought, unless someone just happens to have a copy to share, but I doubt that.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Hmm... progress. How did you install the apk files? What command?

I'm going to start looking into this idea that I just posted on my conversation with another member.

https://xdaforums.com/showpost.php?p=81222729&postcount=29966
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yes, I downloaded bsg3 two days ago, I was going to do the same thing but I also needed a mental break so I haven't flashed yet.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
It seems to me that the boot.img and bootloader from the eng firmware isn't going to work in the stock firmware. I haven't tried anything with the BSG3 firmware yet. Things might be different with it.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
If we can get it to downgrade to Oreo, yes.

I'm going to make a list of Samsung devices that have 7885 then systematically find every firmware for each device, maybe I'll find a rootable binary 4 8.0 firmware that can flash on our device without bootlooping. Then maybe we can get TWRP.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
I don't know, I don't have experience with finding msl or unlocking devices to use on other networks.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yeah, I figure they have us pretty screwed on getting anything to slip through the cracks unless we find a eng root boot.img for this device.

I don't think it can be found for our device, but some places that host/offer/handle eng root .img files have the option to request an eng root boot.img, then I think they create the .img using firmware/stock source for the device that it is requested for.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Yes, I've read logs from eng firmware but I don't really know what I'm looking at, even if I see lines that seem relevant.
[Samsung Galaxy J7 Questions & Answers] DDoyle4:
So, I read this entire thread and I understood half of it. I just want some default Samsung apps off my J7 Crown, like Knox, Workspace, BBCAgent, ect. My phone was remote accessing my laptop and my husband's phone and I have no clue HOW because I cant even open those apps myself. There are all sorts of ****ing apps I dont want on here and now I'm really feeling like I'm ****ed. I downloaded File Explorer Root Browser and BusyBox but apparently that was a waste of time since we cant root this phone. Do you think if I contact Samsung or StraightTalk they will remove them? Lol I just want these invasive apps off my phone.
[Samsung Galaxy J7 Questions & Answers] Droidriven:
Until we find a way to root this thing, the only hope you have of removing unwanted apps is to try the adb method that I posted somewhere in this thread, but, I haven't tried it so I don't know if it will work on this device. It probably won't due to the bootloader being locked and preventing system modifications. You might be stuck with just disabling whatever apps will allow you to disable them.

---------- Post added at 08:52 AM ---------- Previous post was at 08:36 AM ----------

MDM can be disabled by going to system settings>biometrics and security then turn off "Find My Device"

Or, by going to system settings>google>security then turn off "Find My Device"
[Samsung Galaxy J7 Questions & Answers] Droidriven:
We usually learn things when there is a useful purpose to it, most other things we ignore unless we are very interested.
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
A bit late to the party but, I recently just went through this myself and found this site very helpful in removing them.

xda-developers(dot)com/uninstall-carrier-oem-bloatware-without-root-access/

Hope this helps!

Did you ever actually manage a downgrade on this phone? That guide would be appreciated :)

I just got a spare phone, looking to get my hands dirty with experimental things that will likely brick it! Any eng boot roms you have I'd love to try out. I plan on doing a disassembly with pictures of all the chips, as soon as I get a heatgun and some good tweezers.
[Samsung Galaxy J7 Questions & Answers] waterhead69:
Root for samsung galaxy j7 crown
[Samsung Galaxy J7 Questions & Answers] the_R00ter:
What about it
[Samsung Galaxy J7 Questions & Answers] ZafotheNinja:
None yet, working on it ;)