yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
If ypur device is able to be unlocked then yes.. oem unlock will not show.. using paid service will flash a token to the device that unlocks the bootloader.. once this is done then yes, you could root the device.. thats the main reason people unlock their bootloaders lol
[Samsung Galaxy S10+ Guides, News, & Discussion] Beeko:
No I just want the BL unlocked so I can start building custom ROMs as well. Maybe I chose the wrong wording but by reverse development I meant is there documentation for learning how to unlock bootloaders?
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
I am not sure.. sampwnd uses a token to unlock the bootloader.. to unlock it via exploits or some other way you will need to start from scratch i suppose but besides the token method no one has been able to find an exploit to unlock the bootloaders since I believe the Note 4 so good luck in your search!
[Samsung Galaxy S10+ Guides, News, & Discussion] sw1173:
The issue is with Samsung not the snapdragon processor. Samsung claims it's the carriers yet their vendors sell other phones that can be OEM unlocked.
[Samsung Galaxy S10+ Guides, News, & Discussion] Ascendancium:
So not sure if this matters now. But, my G975U has the FRP Lock set to Off. Also I got some pictures if these can help or not!

This screenshots are off my S10+ G975U
[Samsung Galaxy S10+ Guides, News, & Discussion] JhoLou:
Any news? on 2022? i still don't have OEM Unlock option on developers option.
[Samsung Galaxy S10+ Guides, News, & Discussion] Master95:
@elliwigy are you still unlocking this phone's bootloader?
[Samsung Galaxy S10+ Guides, News, & Discussion] ldeveraux:
I'm BL unlocked and rooted on G975USQS4FUA1. Is there any method currently to update to the latest firmware without losing BL unlock?
[Samsung Galaxy S10+ Guides, News, & Discussion] Peppe7783:
Ciao a tutti io uso Google Translate poiché non parlo inglese. ho acquistato un AT&T Galaxy s10plus SM975U e ho notato che non riceve aggiornamenti, il suo Android è 10 e vorrei poter fare un aggiornamento.

Could someone help me thanks in advance
[Samsung Galaxy S10+ Guides, News, & Discussion] Peppe7783:
Hi everyone I use Google Translate as I don't speak English. I bought an AT&T Galaxy s10plus SM975U and noticed that it is not receiving updates, its Android is 10 and I wish I could do an update
[Samsung Galaxy S10+ Guides, News, & Discussion] zombie097:
Elliwiggys site is dead is there any way to get a s10+ rooted anymore?
[Samsung Galaxy S10+ Guides, News, & Discussion] Fly-n-High:
Not for free. I don't agree with this type of commercialization here. I have been able to root, theme, etc for free for years. now it has been compromised and disappointing.

Go get a degree and write embedded controls SW and make real money. I have a EE degree, but it's all been applied engineering. Basically, making other people's **** work in a system and vehicle level.
[Samsung Galaxy S10+ Guides, News, & Discussion] sremick:
His last post was in January but he's been on XDA as recently as Sept 26th.
[Samsung Galaxy S10+ Guides, News, & Discussion] zombie097:
I've talked to him and he has said that he could still get a key but he hasn't been in the business in a while
[Samsung Galaxy S10+ Guides, News, & Discussion] sremick:
Makes it sound like he's just a middle-man for someone else.
[Samsung Galaxy S10+ Guides, News, & Discussion] zombie097:
I believe that is the case
[Samsung Galaxy S10+ Guides, News, & Discussion] sremick:
In that case, if he's "not in the business anymore" then he should just hook us all up with his supplier. There's no reason for the service to go dry just because one middleman decides to get out.
[Samsung Galaxy S10+ Guides, News, & Discussion] Fly-n-High:
Exactly. My point is proven.
[Samsung Galaxy S10+ Guides, News, & Discussion] ldeveraux:
If someone does an amount of work or provides a service, it's up to them whether they charge for it, not you.
[Samsung Galaxy S10+ Guides, News, & Discussion] Fly-n-High:
Your right, it's not up to me. It's also my opinion and I'm entitled to it!
[Samsung Galaxy S10+ Guides, News, & Discussion] ldeveraux:
You're also entitled to be wrong.
[Samsung Galaxy S10+ Guides, News, & Discussion] Fly-n-High:
And so are you...
[Samsung Galaxy S10+ Guides, News, & Discussion] woodman:
Hi,

so it's now time to not derail the thread and to avoid any drama. Please stay civil before it's too late and before the moderation team has to take any actions here.

Thanks!

woodman

Senior Moderator
[Samsung Galaxy S10+ Guides, News, & Discussion] amakuramio:
Shouldn't it be unlockable with system shell exploit that was closed thread on xda recently?

Using web archive.

I think you will need lower version of oneui, but not sure. This exploit was for oneui 3.

I have F version but U motherboards have more storage, performance for much cheaper so I am also interested
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
not sure how that will help... the unlock bit is set correctly and persists to stock firmware when flashing back.. there is sonething else however that is locked or blocking it or the U bl simply doesnt have the ability to fully unlock..

you cannot dump all partitions with system uid.. root is needed.. if system was enough we could simply dd partitions..

only a few partitions are writeable such as steady, persistent, param which need to be writeable by system as it contains stuff like frp or carrier code etc
[Samsung Galaxy S10+ Guides, News, & Discussion] xRaZeR_FuZioNx:
I see. I thought it'd help us find the flash lock bit, but I realize that bit isn't actually changing when doing this unlock.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
Well I do have another exploit.. i can set ro.boot properties.. i currently have ro.boot.flash.locked=0 but unfortunately not able to flash custom firm still in odin

the bl/boot logs still show device is not registering as unlocked
[Samsung Galaxy S10+ Guides, News, & Discussion] xRaZeR_FuZioNx:
Seems like the bit isn't actually changing based on that cmdline, then. Something else has to be setting this bit, definitely at a higher level than we can access now.

I think finding a privilege escalation exploit to add to this chain would help, because at that point we could dump partitions and see whether or not this bit is changed based on the cmdline.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
Yea.. the bit is parsed by the bootloader on a reboot but do not think it actually is setting anything.

I can set any ro.boot props.. not sure if u got any ideas? I have tried setting verified boot state, warranty bit, flash lock, other lock, em status etc. etc. they all change and can be seen in boot logs being set by the bootloader but besides breaking stuff or apps showing theyre set and logs showing theyre set dont seem to do anything so far lol
[Samsung Galaxy S10+ Guides, News, & Discussion] xRaZeR_FuZioNx:
What happens if you change SELinux?
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
which property specifically?
[Samsung Galaxy S10+ Guides, News, & Discussion] xRaZeR_FuZioNx:
I believe it's ro.boot.selinux? Basically the SELinux mode.
[Samsung Galaxy S10+ Guides, News, & Discussion] ExtremeGrief:
ro.config.selinux I think.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
just checked.. its:

ro.build.selinux

ro.build.selinux.enforce

I'll try later but i dont think i can set these.. i found a exploit in the boot up process.. a buffer overflow to be precise..

the bootloader looks for cmdline and takes any props that start with androidboot and converts it to ro.boot and passes it along...

i havent had much luck with other properties but have a few ideas
[Samsung Galaxy S10+ Guides, News, & Discussion] xRaZeR_FuZioNx:
Okay. In the meantime, I'm gonna try to think of other ideas.
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Its starting to sound like Samsung created a false partition mirroring what one would expect to find. If only US cell carrier's would just go back to being dev friendly. Or Samsung could sell dev models like HTC used to do.

It does sound like there might be a brute force method that could be used from where you have gotten.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
im open to suggestions..

sprint s10 5g is bl unlockable.. also i wish vzw sold dev devices like they used to lol
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Now i wonder if the 5g firmware could be modified in some way to be installed on the 4g models.

If you could get a device image of the 5g software before and after bl unlock and compare you should at least be able to find where the unlock bit is located.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
thats the hard part lol.. phones sold out everywhere here
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Hopefully someone with a 5g model will stumble upon this thread and help out.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
i just dled the source code so gonna dig around there also
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
That might help although chances are Samsung omitted anything related to how they locked the bl
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
true.. i actually do kno someone with an unlocked and rooted g977p.. ill have him send me a dump of partitions not in the firmware package such as steady param misc persistent etc etc
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
I would go with a dump of all partitions before and after unlock. They may be different after install and first boot than in the firmware package. I would take a look but i dont have a pc anymore to use. I used to do comparisons in the past out of curiosity. Ill try to help as much as I can though.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
hes in another country thst is well regulated so not too easy uploading large files lol.. ill see what i can get tho.. technically the stock firmware package should b enough for the "before" effect
[Samsung Galaxy S10+ Guides, News, & Discussion] Growking99:
Hello I found this firmware for the G975U and everytime I go to flash with Odin it tells me i need to get permission to use this firmware can anyone tell me why and if it could be used to gain root access

https://ifindhub.com/samsung-galaxy-s10-sm-g975u-sm-g975u1-combination-file.html
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
That is a factory/combination firmware. It's like every other combo firm.. it's not rooted but it's got its benefits and could lead to root easier than a stock firmware could..

To answer your other question, since S10 and newer Samsung implemented a security feature that doesn't allow flashing combo in Odin without approval. I do not believe anyone has found any workarounds either, at least I haven't seen any.

I am able to flash combo firmware (obviously) but the method and files needed to do so are not mine to share. My source doesn't want the masses to know and of course doesn't want Samsung to know either since it is already difficult enough and we don't need sammy patching it too..

Chances are you won't be able to find out how and if u r lucky enough to find someone that knows and is willing to help u I imagine they might try to charge you an arm and a leg due to the nature of it and the needed files are rare.
[Samsung Galaxy S10+ Guides, News, & Discussion] Growking99:
Damn I bet that firmware is the gateway key we need for root on the the SD S10+! Either way I'm sure you or someone else has probably tested it already and i wish you never said anything about teasers that it's possible cuz now until it happens or the day I die I'll be searching for a way to root my S10+ cuz I literally have no "QUIT" in me.
[Samsung Galaxy S10+ Guides, News, & Discussion] innocentone1:
Funny story about that I'll PM you what happened.
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Has anyone compared HK snapdragon firmware files to the US snapdragon firmware files?

Or has anyone successfully flashed HK firmware on the US model?
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
yes and no
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Looks like the combo firmware needs a special pit file in order to be flashed.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
for official method prolly.. i dont think its a pit tho.. i think its a steady.bin/token similar to how they do eng tokens.. i think if factory is allowed it indicates it in dl mode similar to how eng is indicated which usually involves official tokens..

theory is flash factory token in odin then boot to dl mode again and there will be some writing indicating factory binary is allowed..
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Is it possible to do something with EDI like the S8?
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
i tried various methods but it always errors saying writing to lun0 (where the good partitions are) is not allowed even in edl..

there might b a way tho, i just havent found it yet
[Samsung Galaxy S10+ Guides, News, & Discussion] mopartonyg:
You posted the same question in multiple threads and did not read any of them. Try reading a bit and don't post same question all over the forum.
[Samsung Galaxy S10+ Guides, News, & Discussion] LYNNYY:
Well, Thanks For Your ANSWER

WELL DONE!
[Samsung Galaxy S10+ Guides, News, & Discussion] mopartonyg:
Well did you read any of the threads? The post right above yours tells the answer. Don't be a jerk, follow the rules. So just in case you cant read the answer is NO.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
i am actually imching closer n closer.. been workin it all day today lol
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Im definitely waiting for it. Ill probably be the first to verify whatever method comes up. Im willing to test some things here there too.
[Samsung Galaxy S10+ Guides, News, & Discussion] Misterxtc:
Are you testing on BL rev 1 or 2? I ask because many including myself have gone to rev 2.
[Samsung Galaxy S10+ Guides, News, & Discussion] LYNNYY:
fingers cross for you~~~~

hopefully, the glorious path will shows up in no time~~

Cu'z currently, s10 plus with SD chip-set is the only flagship phone I want to get.....

unable to root is the only thing stop me from getting one.........
[Samsung Galaxy S10+ Guides, News, & Discussion] S3BL104:
I have seen somebody successfully flashed G975U1 & G975W firmware on G975U at other forum......
[Samsung Galaxy S10+ Guides, News, & Discussion] crixley:
This has been possible for years now
[Samsung Galaxy S10+ Guides, News, & Discussion] StoneyJSG:
Wow what a read! I have an AT&T S10+ so I am going to join in here even though I don't understand some things that are being talked of.

Would it be possible to attach a dongle via the USB-C port on the phone that sends a pulse to the CPU or bootloader making it temporarily crash long enough to run unsigned code? I know Samsung injected something called vault keeper which was like an extra layer of security or something. I am just speculating here.
[Samsung Galaxy S10+ Guides, News, & Discussion] twoxa:
Let's make it happen, if we need to collect some $ I'm down.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
you can do this normally with odin lol.. factory combo firmware is what ppl cant flash without special methods now as it requires factory approval now..
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
vaultkeeper is there but not really applicable from what ive seen so far.. with my exploits you can set flash lock to 0 which will grey out the oem lock in settings and say bl is unlocked as well as itll say oem unlocked in dl mode..

however despite all this im only able to temporarily oem unlock.. what i mean is that i can oem unlock in dl mode.. reboot straight back into dl mode.. flash a modified img which fails... hard reset and get the red warning saying theres a custom firmware installed but from here it goes to factory reset and after the wipe the red warning is gone and device is not unlocked..

i know it is unlocked for a brief moment in this process because of the warning as well as the logs indicate "IsUnlocked:1" and indicates its oem unlocked before it then reads "IsUnlocked:0" again..

I am going through logs n tests trying to pinpoint exactly when its "unlocked".. I have hope.. this is probably closest any locked usa variants have been since good ole s4 s5 note 4 days to a bl unlock :)

i am also testing methods to write firmware such as modded system..

this stuff is new to me on samsung so its slow moving as im learning as i go.. with pie and beyond theres multiple security measures in place that werent there before such as vbmeta, metadata, hashes, footers, SAR, etc etc.. when i figure one thing out somethin else pops up to stop me lol but this is what makes it fun :)
[Samsung Galaxy S10+ Guides, News, & Discussion] rafaelox24:
Thanks for your efforts dude!
[Samsung Galaxy S10+ Guides, News, & Discussion] StoneyJSG:
Interesting. So the OEM lock does unlock at a certain point temporarily. Is there a way to monitor when it unlocks and relocks? If so, maybe there is a way to halt or freeze it while it is unlocked long enough to get in there and make it a permanently unlocked. Do you think all these OTA security patches that are being rolled out and upgrading the bootloader from v1 to v2 and what not are getting in your way?
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Its looking like the Sprint 5G variant is rootable.

https://xdaforums.com/galaxy-s10-5g/how-to/root-recovery-roms-guide-info-t3957211/post80115429

---------- Post added at 10:48 PM ---------- Previous post was at 10:48 PM ----------
[Samsung Galaxy S10+ Guides, News, & Discussion] StoneyJSG:
If you read the #4 bullet in the OP in that link, it says it's for exynos models only. This thread here, is for discussion of trying to root the snapdragon model G975U.
[Samsung Galaxy S10+ Guides, News, & Discussion] crixley:
Read the comments
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
I linked the exact post
[Samsung Galaxy S10+ Guides, News, & Discussion] sparky2029:
Someone in the comments said they achieved root on the sprint model

Not sure how real/true it is
[Samsung Galaxy S10+ Guides, News, & Discussion] StoneyJSG:
If it's true, then how did they do it? I was under the impression that ALL U.S. models had locked bootloaders and crazy ass security measures to prevent root.
[Samsung Galaxy S10+ Guides, News, & Discussion] sparky2029:
Im extremely curious on how they did it because I too was under the impression that all u.s models were locked. Like I said, I'm not sure if it's real, I just wanted to point out that someone did indeed say they achieved it. Hopefully it's real
[Samsung Galaxy S10+ Guides, News, & Discussion] StoneyJSG:
Ah ok gotcha. I am going to dive into forum thread hell on that post and see if it says how it was done.
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
I was curious so i posted here in case anyone else knew how. It is just a screenshot so it could easily be photoshopped. I do hope it real though as that might aid in rooting regular s10 models
[Samsung Galaxy S10+ Guides, News, & Discussion] nowerlater:
I remember someone saying in developer options, the bootloader could be unlocked on Sprint variant.
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
lol yea.. i was first to report it. i was even in the xda portal/feed fr it.. the 5g model is a g977p however and not the same as the non 5g U variants which are not tyically unlockable..

te 5g variants r all mostly carrier specific as they have different modem technology fr 5g since each carrier is implementing 5g differently..

my n977v for example even ony has vzw csc
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
sprint s10+ 5g aka g977p is bl unlockable and is snapdragon.. i confirmed myself on a store display unit the day it launched
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
it is true lmao..
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
the 5g variant is specific to sprint and is not the same as the U variants. the vzw 5g variant s unique to vzw and is not unlockable bcuz v zw wont allow it whereas sprint does on their carrier specific P models
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
the 5g sprint P model they unlock the bl then flash magisk patched file in odin.. same way everyone else does it that can bl unlock
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
these were some of the pics i took and were featured in the xda portal/feed when i reported it to one of the authors.. sprints 5g models are unlockable.. vzws 5g models arent.. regular U/U1 models are also not unlockable.. i am still working on it tho
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Would having the unlockable firmware help find where it is that they lock it then? The way it sounds is that Qualcomm is the one keeping it locked.
[Samsung Galaxy S10+ Guides, News, & Discussion] RaverX3X:
Have you tried to grab a ota package, extract the boot image and patch it with magisk then flash it back to the device? Just an idea. In all honesty you can use the stock recovery to flash things unless that has changed, we did that on the sgs4g :)

---------- Post added at 10:56 AM ---------- Previous post was at 10:50 AM ----------

sadly in that state even though you flagged it as unlocked bl it still is locked, you can take any locked bootloader device and flash to the recovery it will fail at 99% the same way. If you actually had unlocked the bootloader it would have passed, unless you tried to flash it to the wrong recovery partition.
[Samsung Galaxy S10+ Guides, News, & Discussion] sparky2029:
Damn, that's awesome. I wish this was doable on all S10 models..
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
I am able to get the abl to report it is unlocked but problem is it relocks before I can flash i.e i believe after the mandatory wipe.. the odin failures vary depending on when or how i flash. If I dont oem unlock then it fails instantly with a secure check fail.. when i oem unlock it goes to 100% before failing. In the event I force flash vbmeta kicks in only.

I think vbmeta aka avb is whats holding me back. I can flash any vbmeta via other means but since its one of the first partitions to load and contains the hashes n other verification stuff it wont boot..

I do have some further ideas however.. i can set kernel cmdline.. i have been reading up on source and I might b able to disable the checks or rather have the abl do it for me..

either way, there is still hope but with onky myself working it like usual it will take time..

I also am experimenting with EDL and I also have full eng firmware and other stuff to work with so only a matter of time before i at least can root.. I already have system uid access and other exploits so just digging through code trying to find another exploit to chain to hopefully root..

I can boot any official vbmeta including eng but its specific to each firmware so for example if i am using eng vbmeta it will complain about the hashes not matching other partitions.. I can even boot with a modified vbmeta but it complains about not having the footers etc etc.. There are certain ro.boot properties that are passed by abl to kernel cmdline that can disable or ignore corruption etc. which will b my next tests..

lastly i have been gettin further with edl flashing.. it also doesnt allow flashing to lun0 but i am reading where others have worked around this so edl is still a definite path to root as well.
[Samsung Galaxy S10+ Guides, News, & Discussion] jwarrior319:
Are you working with BL V1 or V2? Or will it not matter?
[Samsung Galaxy S10+ Guides, News, & Discussion] elliwigy:
g975u on rev2 and n976v on rev1
[Samsung Galaxy S10+ Guides, News, & Discussion] StoneyJSG:
Oh okay gotcha. Well keep working on it, it seems you have made some progress. I would help, but I got lost at footers and ro.boot