[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
I have more experience in edl then i gave myself credit for lol

samsung also enforces signature from hardware so flashing any custom boot or recovery will not work unless you figure out some way to disable or bypass secure boot.. i can root n960u for example as well as my sampwnd root on s8/s8+ and also samfail on n8 are examples.. with root on these devices u can force a custom boot or recovery but in doing so device will secure check fail and refuse to boot..

eng firmware is also not possible.. i also had full eng firmware for s8/s8+ (system was used in sampwnd root) but the eng boot and recovery will not boot even when forced onto the device as it will boot to dl mode and tell u its eng binary and refuse to boot until u flash normal user binary boot/recovery

its even more secure now as essentially none of the eng firmware will work.. u can edl flash the bootloaders that will boot/work but itll onky go to dl mode and complain about vbmeta (u cannot flash any of the other firmware due to write protection as well as binary checks so the rest of the firmware fails verified boot.)

even debug vbmeta which can b flashed will not work as it also requires approval/debug token to boot it..

you cannot create your own firehose programmers (if thats what you mean) because these are also required to be sogned by samsung and are verified when loading them.. the rev also needs to match.. if it doesnt check out then programmer fails to load altogether..

the xmls on the other hand can be custom.. i have a number of debug files related to edl including build files, drivers and already built n signed binaries that i dont really know how to use such as qsee.elf, mon.elf, uefi.elf, jtagprogrammer.elf etc etc that are built specifically for g975u rev2 by qualcomm.. i also have multiple programmers outside of the normal ones including nohash, merged etc etc.

i am fully aware of the different tags that can b used as ive made numerous full backups/dumps using fhloader and other tools like emmcdl or qsaharaserver etc.

the peek/poke tags are also not allowed on sammy sd devices..

i personally dont believe all qc devices/edl mode are the same as this can also be customized by the oem as is the case with samsung.. they restrict certain features and limit the capabilities..

and yes, that is what i meant by editing the gpt.. for example if edl doesnt allow flashing say system on lun0 at offset xxxx then maybe resizing it or moving the offset somehow might allow it to be flashed, i just dont really mess with gpt.. i hear one wrong move and you could kill the device for good lol.

but as i stated, if u got some skills and think u can crack it then by all means message me and we can collaborate and see what im able to share files wise.. u can hit me up on tgram for quicker replies and also i prefer it when communicating or sharing files of it gets to that point..

i also have some other tricks up my sleeve such as factory approval/token bypassing, system uid on any combo firmware and other vulns ive found that might also help..

also, its being patched already but most devices can be put into edl mode very easily by corrupting the xbl through odin.. one way is to rename abl.elf to xbl.elf then flash in odin.. this is much easier and efficient than test points although i also know where they are on g975u and other devices as i typically manage to somehow hard brick my hard bricks to the point i need test points to save my device lol for anyone else reading this i recommend u dont do this as u will be "bricked" and if u dont have the files or know how then you will be sol or have to pay someone to repair your device lol