[Galaxy A3, A5, A7, A8, A9 Q&A, Help & Troubleshoot] rmmprenormal:
### Small backstory, skip if you only care about the logcat part:

- This phone (A520F) is a hand-me-down from my mother.

- I successfully install Lineage to it a few year back since she complain that the phone has been slow.

- I had to come back to stock because Lineage modem didn't work at the time.

- I receive the phone recently (about 1 month ago, this is important), check dev option, no oem unlock, so I assume the bootloader is still unlocked.

- I factory reset the phone, after removing her google account.

- With OEM Unlock still missing from dev option, I reboot to Download mode, and RMM is Prenormal.

- Seems like the phone is still Prenormal after 3-4 years of usage from my mother (or from when I reset it, but I don't think so), good job Samsung.

- I waited 7 days on wifi, no sim, no google, no samsung,... the first time, didn't work.

- So I tried all sort of stuff, change time, miracle box, combination rom,.. didn't work.

- I flash stock, waited 7 days again, with sim, wifi, still no account, didn't work.

- I flash stock, waited 7 days, this time I use sim, wifi, log in to google, samsung, I even sign up for samsung find my mobile. I accept all update (software only, because firmware is the latest already), still didn't work.

- But this time, I installed logcat reader and give it permission via adb, and the result were... interesting.

### The logcat for the whole rmm system (rlc, vaultkeeper,...) is pretty verbose, so I got to understand it quite a bit:

1. Everytime I open developer setting, this happens:

[02-14 23:16:53.127 2469:2469 I/VaultKeeper]
[Client] com.android.settings => [Vault] RemoteLockControl (2.8.6)

[02-14 23:16:53.127 2469:2469 I/VaultKeeper]
[CMD:REGISTERED]

[02-14 23:16:53.127 2469:2469 I/VaultKeeper]
prepare done(0)

[02-14 23:16:53.127 2469:2469 I/VaultKeeper]
preProcessing done(0)

[02-14 23:16:53.127 2469:2469 I/TeeDriverClient]
driver client open [hardware/samsung_slsi/exynos7880/mobicore/ClientLib/src/driver_client.cpp:103]

[02-14 23:16:53.152 2469:2469 I/VaultKeeper]
openSession done(session id : 3073, device id : 0)

[02-14 23:16:53.152 2469:2469 I/VaultKeeper]
notify done(session id : 3073, device id : 0)

[02-14 23:16:53.197 2469:2469 I/VaultKeeper]
waitNotification done(session id : 3073, device id : 0)

[02-14 23:16:53.198 2469:2469 I/VaultKeeper]
closeSession done(session id : 3073, device id : 0)

[02-14 23:16:53.198 2469:2469 I/TeeDriverClient]
driver client closed [hardware/samsung_slsi/exynos7880/mobicore/ClientLib/src/driver_client.cpp:113]

[02-14 23:16:53.198 2469:2469 I/VaultKeeper]
cmdProcessing done(0)

[02-14 23:16:53.198 2469:2469 I/VaultKeeper]
postProcessing done(0)

[02-14 23:16:53.198 2469:2469 I/VaultKeeper]
runCommand Success.(TA ret = 0)

[02-14 23:16:53.199 18955:18955 I/RlcManager]
query(void)

[02-14 23:16:53.200 2469:2469 I/VaultKeeper]
[Client] com.android.settings => [Vault] RemoteLockControl (2.8.6)

[02-14 23:16:53.200 2469:2469 I/VaultKeeper]
[CMD:READ_STATE]

[02-14 23:16:53.200 2469:2469 I/VaultKeeper]
prepare done(0)

[02-14 23:16:53.204 2469:2469 I/VaultKeeper]
vk_read_vault_from_steady: Read success vault - front

[02-14 23:16:53.204 2469:2469 I/VaultKeeper]
preProcessing done(0)

[02-14 23:16:53.204 2469:2469 I/TeeDriverClient]
driver client open [hardware/samsung_slsi/exynos7880/mobicore/ClientLib/src/driver_client.cpp:103]

[02-14 23:16:53.228 2469:2469 I/VaultKeeper]
openSession done(session id : 3073, device id : 0)

[02-14 23:16:53.228 2469:2469 I/VaultKeeper]
notify done(session id : 3073, device id : 0)

[02-14 23:16:53.275 2469:2469 I/VaultKeeper]
waitNotification done(session id : 3073, device id : 0)

[02-14 23:16:53.276 2469:2469 I/VaultKeeper]
closeSession done(session id : 3073, device id : 0)

[02-14 23:16:53.276 2469:2469 I/TeeDriverClient]
driver client closed [hardware/samsung_slsi/exynos7880/mobicore/ClientLib/src/driver_client.cpp:113]

[02-14 23:16:53.276 2469:2469 I/VaultKeeper]
cmdProcessing done(0)

[02-14 23:16:53.276 2469:2469 I/VaultKeeper]
postProcessing done(0)

[02-14 23:16:53.276 2469:2469 I/VaultKeeper]
runCommand Success.(TA ret = 0)

[02-14 23:16:53.276 18955:18955 D/DevelopmentSettings]
enableUnlock rlcState : Prenormal

It seems like the setting app is calling the VaultKeeper service to check for rmm status, fine.

2. The logcat from RLC itself is more interesting, and explains a lot:

[02-15 03:14:27.078 2955:2955 D/RLCCLIENTTRACE_LOG_PCWCLIENTTRACE_MUMUtils]
MUM IsOwner : true

Yes I am the owner, now unlock my phone please.

[02-15 03:14:27.078 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.RetryReceiver]
com.samsung.android.rlc.CHECK_DEVICE_STATUS_RETRY

[02-15 03:14:27.079 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.RetryReceiver]
ACTION_CHECK_DEVICE_STATUS_RETRY

[02-15 03:14:27.079 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
startTask : INIT

[02-15 03:14:27.079 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
[RmmTask] Thread is null

[02-15 03:14:27.080 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
[RmmTask] queue size : 1

[02-15 03:14:27.086 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
[RmmTaskQueue] take

[02-15 03:14:27.091 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
onHandleIntent : CHECK_INIT_STATUS

[02-15 03:14:27.091 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CheckRegistrationHandler]
CheckDeviceStatusManager run

[02-15 03:14:27.092 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CertHandler]
[getEncrytedData]

[02-15 03:14:27.093 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.PreferencesUtil]
Get Key : cert Value : null

[02-15 03:14:27.094 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.PreferencesUtil]
Get Key : registeredimei Value : null

[02-15 03:14:27.095 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.RLCUtil]
[InitRlcInstance] Already Exist

[02-15 03:14:27.095 2955:21296 I/RlcManager]
getClientData

[02-15 03:14:27.095 2955:21296 I/RlcManager]
getRlcVaultData

Ok, but why does it say "RETRY" tho. It's going to be clear in the next part.

[02-15 03:14:27.349 2955:21296 W/System.err]
org.json.JSONException: No value for IMEI_1

[02-15 03:14:27.353 2955:21296 W/Sys
at org.json.JSONObject.get(JSONObject.java:392)

[02-15 03:14:27.353 2955:21296 W/System.err]
at org.json.JSONObject.getString(JSONObject.java:553)

[02-15 03:14:27.353 2955:21296 W/System.err]
at com.samsung.android.rlc.util.RLCUtil.getIMEI(RLCUtil.java:178)

[02-15 03:14:27.353 2955:21296 W/System.err]
at com.samsung.android.rlc.util.DeviceUtil.getDualSIMDeviceID(DeviceUtil.java:68)

[02-15 03:14:27.353 2955:21296 W/System.err]
at com.samsung.android.rlc.receiver.handler.CertHandler.getCertBody(CertHandler.java:154)

[02-15 03:14:27.353 2955:21296 W/System.err]
at com.samsung.android.rlc.receiver.handler.CertHandler.encryptData(CertHandler.java:40)

[02-15 03:14:27.354 2955:21296 W/System.err]
at com.samsung.android.rlc.receiver.handler.CheckRegistrationHandler.run(CheckRegistrationHandler.java:42)

[02-15 03:14:27.354 2955:21296 W/System.err]
at com.samsung.android.rlc.service.RmmTask.handleIntent(RmmTask.java:133)

[02-15 03:14:27.354 2955:21296 W/System.err]
at com.samsung.android.rlc.service.RmmTask.-wrap0(Unknown Source:0)

[02-15 03:14:27.354 2955:21296 W/System.err]
at com.samsung.android.rlc.service.RmmTask$RmmTaskQueue$RmmTaskThread.run(RmmTask.java:441)

A bunch of rlc warning. It said that (JSON, not RLC) can't find IMEI_1, but that's wrong. The IMEI match with the one on the box, and RLC still hash the IMEI to send to the server anyways.

[02-15 03:14:27.358 2955:21296 I/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CertHandler]
IMEI Len : 2

[02-15 03:14:27.358 2955:21296 I/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CertHandler]
IMEI value : censored by me=

[02-15 03:14:27.359 2955:21296 I/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.PushUtil]
[getRLCClientVersionName]Version : 2.2.05

[02-15 03:14:27.360 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.HttpRequestHandler]
URL : https://rmm.samsung.com/dm/v1/dev/getCert5 Request : <request><imeiHash>censored by me=</imeiHash><imeiHash2>censored by me=</imeiHash2><ver>2.2.05</ver><model>SM-A520F</model><csc>XXV</csc></request>

This seems like the key to all of this. RLC sent a request to Samsung server at the URL above, but guess what: The certificate of the server expired roughly 70 days ago, god fking damn it. I also found these logs below, which seems to be the same cert that the server use.

[02-15 03:14:44.673 2955:21296 E/Conscrypt]
------------------Untrusted chain: ----------------------

[02-15 03:14:44.673 2955:21296 E/Conscrypt]
== Chain0 ==
Version: 3

[02-15 03:14:44.673 2955:21296 E/Conscrypt]
Serial Number: censored by me

[02-15 03:14:44.674 2955:21296 E/Conscrypt]
SubjectDN: CN=*.samsung.com, OU=PremiumSSL Wildcard, OU="Hosted by Korea Information Certificate Authority, Inc.", OU=Cloud Operation Group, O="Samsung Electronics Co., Ltd.", STREET="129, Samsung-ro, Yeongtong-gu", L="Yeongtong-gu, Suwon-si", ST=Gyeonggi-Do, OID.2.5.4.17=16677, C=KR

[02-15 03:14:44.674 2955:21296 E/Conscrypt]
IssuerDN: CN=Sectigo RSA Organization Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB

[02-15 03:14:44.674 2955:21296 E/Conscrypt]
Get not before: Mon Oct 07 07:00:00 GMT+07:00 2019

[02-15 03:14:44.674 2955:21296 E/Conscrypt]
Get not after: Tue Nov 30 06:59:59 GMT+07:00 2021

So yeah, after 30 November 2021 you are fked, apparently. And since the server didn't return anything, rlc spit out a bunch of errors.

[02-15 03:14:44.746 2955:21296 E/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.HttpRequestHandler]
requestHttp] IOException- javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

[02-15 03:14:44.747 2955:21296 W/System.err]
java.lang.NullPointerException: Attempt to invoke virtual method 'com.samsung.android.rlc.vo.DeviceApiResponseVO com.samsung.android.rlc.receiver.handler.HttpRequestHandler$RESPONSE.getResponseBean()' on a null object reference

[02-15 03:14:44.747 2955:21296 W/System.err]
at com.samsung.android.rlc.receiver.handler.CertHandler.encryptData(CertHandler.java:44)

[02-15 03:14:44.748 2955:21296 W/System.err]
at com.samsung.android.rlc.receiver.handler.CheckRegistrationHandler.run(CheckRegistrationHandler.java:42)

[02-15 03:14:44.748 2955:21296 W/System.err]
at com.samsung.android.rlc.service.RmmTask.handleIntent(RmmTask.java:133)

[02-15 03:14:44.748 2955:21296 W/System.err]
at com.samsung.android.rlc.service.RmmTask.-wrap0(Unknown Source:0)

[02-15 03:14:44.748 2955:21296 W/System.err]
at com.samsung.android.rlc.service.RmmTask$RmmTaskQueue$RmmTaskThread.run(RmmTask.java:441)

[02-15 03:14:44.748 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CertHandler]
Exception : java.lang.NullPointerException: Attempt to invoke virtual method 'com.samsung.android.rlc.vo.DeviceApiResponseVO com.samsung.android.rlc.receiver.handler.HttpRequestHandler$RESPONSE.getResponseBean()' on a null object reference

[02-15 03:14:44.748 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CertHandler]
getCert returns null

[02-15 03:14:44.748 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CheckRegistrationHandler]
Cert body is null

[02-15 03:14:44.748 2955:21296 I/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.CheckRegistrationHandler]
[setRetry]

"Trust anchor not found", "Cert body null". Welp, and I was screaming in happiness when I saw RLC connect to that server too, god damn... So anyways, RLC "retry", and we can see its effort below.

[02-15 03:14:44.750 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.PreferencesUtil]
Get Key : retry_14 Value : 1644174112778

[02-15 03:14:44.752 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.PushUtil]
Scheduling retry , back off time : 72000000(com.samsung.android.rlc.CHECK_DEVICE_STATUS_RETRY)

[02-15 03:14:44.754 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.PushUtil]
Retry back off for check api is max value

[02-15 03:14:44.754 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
Register Connectivity Receiver

[02-15 03:14:44.757 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.ConnectivityReceiver]
Action : android.net.conn.CONNECTIVITY_CHANGE

[02-15 03:14:44.757 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.ConnectivityReceiver]
[type: WIFI[] - WIFI, state: CONNECTED/CONNECTED, reason: (unspecified), extra: "ayy lmao", failover: false, available: true, roaming: false, metered: false]

[02-15 03:14:44.757 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.ConnectivityReceiver]
Network Connected

[02-15 03:14:44.757 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
startTask : INIT

[02-15 03:14:44.758 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
[RmmTask] queue size : 1

[02-15 03:14:44.758 2955:2955 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
Unregister Connectivity Receiver

[02-15 03:14:44.759 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
[RmmTaskQueue] take

[02-15 03:14:44.760 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.service.RmmTask]
onHandleIntent : INIT

[02-15 03:14:44.761 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.receiver.handler.BootHandler]
cscEnable : false

[02-15 03:14:44.761 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.RLCUtil]
[InitRlcInstance] Already Exist

Yeah so it retry after 72000.. something, miliseconds maybe, I don't know. And I don't really understand this part, but it seems like RLC has retried a bunch of time already. But since the server is gone, even if it retry till the heat death of the universe, it's not gonna unlock the phone for me.

[02-15 03:14:44.762 2469:2469 I/VaultKeeper]
[Client] system_server => [Vault] RemoteLockControl (2.8.6)

[02-15 03:14:44.762 2469:2469 I/VaultKeeper]
[CMD:READ_STATE]

System server polling....

[02-15 03:14:44.840 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.RLCUtil]
[getRLCStatus] RLC Status : Prenormal

[02-15 03:14:44.840 2955:21296 D/RLCCLIENTTRACE_LOG_com.samsung.android.rlc.util.RLCUtil]
[InitRlcInstance] Already Exist

...only to rub salt on the wounds. How about:

if (isOwner && rlcStatus == "Prenormal") {
rlcStatus == "Checking";
}

That solution too dumb for you smart-asses or something?

Bottom line, seems like I'm **** out of luck.

### Going forward:

- There is something that I haven't tried: the NAND erase/ Repartition checkbox in Odin, but I'm scared that it would brick my phone even with the correct pit file, and even more scared that it not gonna solve anything (it seems like the rmm state is stored in the param partition, but don't quote me on that cause I don't even remember where I saw that). If you have any ideas about how those checkbox work, please please please tell me.

- Paid service also exist but I can't do that for now, and it's pretty expensive too (I also don't trust a lot of them).

- So yeah, this is everything I know about the adbomination called RLC, and it's safe to say that I will never, ever touch a Samsung phone again (except if it's a free hand-me-down lol).

### Thank you for reading, hope you learn something, or even better, have a solution for me haha.