yashsingh1/xdaforums huggingface dataset:
[Android General] K0mraid3:
ty,And i just realized i didnt sign the POC, so use app manager to sign it till i can rebuild with a signed version
[Android General] K0mraid3:
cant "ls" but will see if i can play around
[Android General] K0mraid3:
fixed the unsigned POC apk, its now signed and should work with no issues. Thanks @Skorpion96 for pointing it out and @oakieville for the quick signing.
[Android General] wr3cckl3ss1:
All this couldn't be possible without the help of Taco Telecom and Bueno Mobile in association with Spielberg Pixtures ®

ENTER THE DRAGON

am start -n com.sec.hiddenmenu/.KOREA_Mode -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.KoreaMode_Prevail -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.SerialPort -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.ItsOnMenu -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.ServiceModeApp -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.Test -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.PhoneUtil -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.OTATest -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.LTE -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.FIELDTESTMODE -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.HiddenMenuEnable -e 7267864872 72678647376477466

am start -n com.sec.hiddenmenu/.GlobalHiddenMenuEnable -e 7267864872 72678647376477466

wr3cckl3ss1
[Android General] Romeo Nickolas:
Sorry I'm not good on android commands.

I tried using meth 2 using the app and it was a success and opens a cmd app. Is that the system shell where I need to input the command to open the iothiddenmenu?

I tried to paste it there but nothing happens.
[Android General] K0mraid3:
We will get together on how best to make a good, informative post with all the cool stuff we (and now YOU!) can do with this exploit for you guys, but here's just a quick list of some things from IOTHidden menu you guys can try! in the meantime, i recommand playing with the "am start -n" command in the system shell!
[Android General] irshansk:
Could you please help me with this then? :) It would be awesome - I hate T-Mobile voicemail app soo much.
[Android General] wr3cckl3ss1:
First things first...can you show me what CSC you have in your About Software
[Android General] Mastercodeon:
Has anyone tried this on an s22 ultra? SM-908U here, i bet this could turn into a full root given enough development.
[Android General] K0mraid3:
ahhh, ok, If this issue occurs, try closing out SMT (Samsung TTS) on device completely, make sure your device has the screen on and awake (Not at lockscreen, go to home screen), make sure you are either plugged in with USB or connect via ADB Wifi, (check this by right clicking INSIDE the folder you made for the second method, and open it in a terminal, then do "adb devices", you should see atleast one device pop up in the message it gives you back
[Android General] K0mraid3:
Yes, Confirmed to work on S20, S21 and S22 all Variants.
[Android General] wr3cckl3ss1:
As the battle tester....i have a S908U..... interchangeable to S908U1...affects firmware as of January 2023

And also affects Watch 4 Classic....any device that carries SMT and can rollback is affected....about 80 percent of the market.
[Android General] irshansk:
XAA/XAA,XAA/XAA because I did overwrite csc using samfw and I did disable cidmanager to avoid automatic switch.

Default CSC without any modifications I did is TMB/TMB,XAA/XAA
[Android General] oakieville:
Is the cmd window blank if so it did not start shell also what device and sndroud is it
[Android General] wr3cckl3ss1:
Ok....can you get preconfig up without issue?

Also what device and can your device be switched to like a U1 variant. What I'm looking for the the CSC of XAR....but your CSC tile has to have this.....
[Android General] Mastercodeon:
Thats actually insane. I'll be taking a look at this for sure. Pretty exciting things
[Android General] Romeo Nickolas:
Adb shows my device using USB.

Btw after running the app it opens an app on my phone to download language pack.

And yes it show a blank cmd.

My device is note 20 ultra 5G

SM-N986W

XAC XAC XAC XAA

Android 13 oneui 5.0
[Android General] wr3cckl3ss1:
The usual players were given notification but as they don't know the full extent and live in the world of being able to have root....many passed. But I'm sure with this now out in the open.....there will be several intelligent people to maybe hammer out anything that the group couldn't cover or didn't discuss. So this is an open call to anyone willing to help the cause and crack things wide open.
[Android General] Mastercodeon:
Thats a big bet, something is defiantly going to come out of this
[Android General] adfree:
I give up to find alternate way...

I can use EXE from this Zip:

Komraids System Shell V4.5.zip

And few users allready confirmed success with this EXE...

SM-R860 GVK7

SM-R895F GVK6

And 1 more user with SM-R875F like me... started with AUGF Firmware successfully.

So we were able to change CSC.

So thank you very much for this powerfull Exploit.

And the EXE. :cowboy:

Best Regards
[Android General] wr3cckl3ss1:
You're welcome. Just make sure to give OP and myself credit if you do decide to make a guide and post on XDA. Also note..that this does NOT work, for now, on Watch 4 from US. But I'm still looking into this issue. So I'm on the case.
[Android General] mohitgalaxy3:
I am trying to connect manually as exe is blocked in my office laptop, I created two shell session and in the 2nd one when I did 'am start -n com.samsung.SMT/.gui.DownloadList' it opens up the install voice data page and stuck there. I have also uninstalled updates from TTS app. Is there anyway I can connect manually.
[Android General] wr3cckl3ss1:
Enter The Dragon

Courtesy of Vault-Tec DevOps & System Shell
[Android General] Pawar Mukesh:
Kindly correct me if I'm not mistaken, this essentially allows Samsung devices in the U.S. Region to have their bootloaders unlocked.

Is bootloader unlocking a one-time process or does each device require a reboot afterward?

P.S. We must follow the rooting instructions for a specific Samsung model after unlocking the bootloader, correct?
[Android General] wr3cckl3ss1:
I kindly ask you to refer to the OP for this question.
[Android General] mohitgalaxy3:
I am trying to get into Phone Util service mode using 'am start -n com.sec.android.app.modemui.activities.PhoneUtil' but it doesn't work. Can you please help me out.
[Android General] Romeo Nickolas:
Someone already answered your question

But here it is

am start -n com.sec.android.app.servicemodeapp/com.sec.android.app.modemui.activities.PhoneUtil
[Android General] mohitgalaxy3:
Thanks unfortunately this also doesn't bring up any kind of service menu. Not sure how to enable CA on KOO csc.
[Android General] subevilx:
Y

Yes ik about e tokens and I did try to modify my comb files but sadly i cant flash them i get auth fail error my device is s22 s901u but flashed to s901w so if you can help i would appreciate it
[Android General] subevilx:
Hi i tried editing the comb file using CRB / android kitchen but im failing as I only found build.prop in recovery.img and boot.img is the main this so if u find anything let me know would appreciate it
[Android General] subevilx:
HOW?
[Android General] Romeo Nickolas:
Is there a hidden settings to edit LTE anchor bands of 5G bands? I tried all iothiddensettings but there’s no settings to edit it.
[Android General] mohitgalaxy3:
this is awesome.
[Android General] wr3cckl3ss1:
So that's what your looking for.....how to enable CA....you could of been more direct and shared a bit more information. Also....you out that you want it on KOO, so you have a different device. When the method on how to call those menus from the video i posted does come out, it may or may not work for you specifically. But you never know. But as of now...i cannot give that out yet. But soon.....
[Android General] wr3cckl3ss1:
Wait what do you mean you flashed S901W firmware....on a S901U....that shouldn't of happened because you would of got a pit file error.
[Android General] wr3cckl3ss1:
All in due time...
[Android General] subevilx:
U can do this man u wont use modded odin
[Android General] Romeo Nickolas:
This is possible just use the patch odin version. It can also revert it back without loosing data by flashing home csc as long as it has the same security update version.

I’m on SM-N986U1.
[Android General] Romeo Nickolas:
After applying this it will just restart the phone but it won’t save the settings. Maybe there’s a specific CSC to make it work. I’m on XAA.
[Android General] wr3cckl3ss1:
Send me a DM
[Android General] wr3cckl3ss1:
That's news to me because i tried this going from S908U to S908W using a patched Odin and got immediate pit errors. But i did this many months ago when the time the S22 Ultra came out. But now I wonder...
[Android General] Romeo Nickolas:
I suggest you remove the passcode first if you want to try it without loosing data since I experienced wrong passcode after flashing the firmware.
[Android General] wr3cckl3ss1:
One day I'll try soon. After heavy testing the past two days and 2 weird factory resets. I'm taking a break on flashing anything. But i will keep this in mind.
[Android General] Romeo Nickolas:
Is there a settings or command to change anchor lte band on 5G bands using this shell?
[Android General] wr3cckl3ss1:
To my knowledge NO but i could wrong. Anything is possible. I would look at the activities that have the word "edit" in them. Maybe there's a chance those lead to being able to change.
[Android General] Romeo Nickolas:
I already tried all iothiddenmenu settings and yes ALL settings one by one using the shell. But there's only an option to enable/disable 5G nothing more about 5G or anchor bands.

I don't know why samsung locked anchor bands on this sm-n986u1 model. I tried all possible ways like changing values on efs but nothing works.
[Android General] kienns1996:
So magical. I have successfully changed the CSC on my S906N
[Android General] subevilx:
Guys any way to disable roll back fuse? I want to go back to android 12 but it has U1 binary please help
[Android General] K0mraid3:
I think there may be a way, but

i have NOT tried it

and

it could cause some serious issues since AOSP no longer officially supports SDCARDFS after Android 11

.... But theres a couple of props that relate directly back to FUSE

setprop persist.sys.fuse false

setprop persist.fuse_sdcard false
[Android General] mohitgalaxy3:
@wr3cckl3ss1

So initially I was looking to change CSC and had no idea that CA thing won't work.

I am getting poor network speed on LTE and it never shows LTE +, whereas my other phone shows LTE+ with much better speed because it was bought from India. So here are the things I am looking for:

1. In *#0011# it shows CA 1 for few mins and then 0, so I am trying if this can be fixed somehow either by enabling more CA combinations or tweaking some other settings which I still didn't find.

2. If by any chance it's possible to flash INU csc which is for SM-G998F and my device is SM-G998N.

3. if possible enable E-Sim.

CA menu looks promising, please tag me whenever you can share and will definitely appreciate if you can help to fix above things. On XDA and Google found very limited things for Exynos most of them are for SD using QPST.
[Android General] mohitgalaxy3:
Yes I was happy too when I changed csc to KOO from KTC, since you are having N device I am wondering if you have done any fixes for 4G+ or any other settings to improve network speed.
[Android General] kienns1996:
you can't change the band on KOO csc, but I have another way to access the band setting menu on LUC, SKC or KTC
[Android General] kienns1996:
actually there is a way to access it on KOO, but i still haven't figured out how, actually i don't care because i live in korea
[Android General] kienns1996:
i figured out how to access hidden menu on KOO csc, open dialer and enter 319712358, password is 996412. You are in hidden menu :)))
[Android General] mohitgalaxy3:
I have access to that hidden menu for all CSC but only useful thing that menu has is to do Band Selection, other than that I didn't find anything to improve LTE speed or LTE CA.

Also was wondering if you have any idea on WWD csc.
[Android General] kienns1996:
i tried switching to WWD, it's very clean and almost no extra apps pre-installed. but I'm worried that WWD won't get updates from samsung...
[Android General] mohitgalaxy3:
yeah its identical to KOO but didn't understand the difference. I have also noticed that some S22 Us or global units are getting WWD CSC.
[Android General] wr3cckl3ss1:
U1 firmware has this....but it doesn't allow you access to use eSIM....
[Android General] kienns1996:
with WWD, the hidden menu is more accessible (I think so, I can access USBSettings via code *#0808#, moreover I can change back to KOO csc via SamFW FRP tool). In short, at WWD, there may be a method that will help you
[Android General] mohitgalaxy3:
Let me jump to WWD and explore...are you able to access hidden menu on WWD ?
[Android General] kienns1996:
i think it is possible to access it through secret codes, or through adb uid 1000
[Android General] mohitgalaxy3:
ok changed the CSC, will explore apps and service menu's.

However I don't see any firmware for WWD on sammobile so OTA won't work for sure.
[Android General] kienns1996:
that's why i came back to KOO
[Android General] mohitgalaxy3:
319712358 doesn't work on WWD and also hiddenmarketmenu was not there. Nothing extra in Service menu either.

changed back to KOO for now. Will keep exploring.

Service menu shows 13 CA combo's but don't know why it doesn't connect and show LTE+.
[Android General] kienns1996:
I didn't care about 4g or LTE, my phone was just showing LTE, but its speed was pretty amazing...
[Android General] subevilx:
any other way like can I modify the firmware in someway so it works?
[Android General] mohitgalaxy3:
Yes because you are in Korea and since I am using this in India speed sucks for me.

Have also noticed that in network guru app my phone always locked on to band 40 and shows only 1 band/connection where as in my other phone it picks up 6 to 7 always.
[Android General] wr3cckl3ss1:
Have you checked out these?
[Android General] mohitgalaxy3:
Yes I have access to the band menu, tried keeping LTE B1 to B8 that makes diff in speed but no help in getting LTE+
[Android General] adfree:
@subevilx

Search for text string in boot.img and/recovery.img

SEANDROIDENFORCE

both together at end of file...

SignerVer

This is the additional signing crap before AVB...

Here you can find text string mrk or fac like factory

On my GW4 I was able to modify Factory aka Combination Firmware boot.img AND recovery.img to flash WITHOUT eToken

Tested on SM-R870 and SM-R875F...

But Bootloader is unlocked AND patched vbmeta.img...

WARNING!

This could be very dangerous to your device and deadly if out of luck...

Edit 1.

some additional info... make_signerv2_header.sh

https://xdaforums.com/t/rooting-galaxy-watch4.4452343/page-11#post-87698151

Edit 2.

And here example what I mean with deadly...

https://xdaforums.com/t/rooting-galaxy-watch4.4452343/page-10#post-87620211
[Android General] subevilx:
hi how were u able to flash comb file i got a s20 oem unlocked i want to flash comb on it
[Android General] subevilx:
also one more question how did u edit the boot.img im using crb to edit boot file but i can never flash it even without editing anything
[Android General] adfree:
@subevilx

My skills are limited to Bruteforce 1 or 2 Bytes...

So I used WinHex to change text string in boot.img and recovery.img

fac

into text string:

mrk

So this is my "magic" 3 Byte "hack"... :giggle:

To flash Factory boot.img and recovery.img into mrk like Market device...

Best Regards
[Android General] subevilx:
can I DM u?
[Android General] subevilx:
this is what I found what should i do
[Android General] adfree:
@subevilx​

IMHO this is normal boot.img...

Now check from Combination Firmware... boot.img

You should see fac instead mrk...

Best Regards

Edit 1.

As Example in HEX because this is not only text...

5345414E44524F4944454E464F5243455369676E65725665723033000000000033373438343633305200000000000000464152305F47393931425858553141554133000000000000000000000000000032303231303131353138303530310000534D2D47393931425F4555525F58585F454B45593000000000000000000000005352505448313943303031000000000053525054483139433030310000000000757372006672700066616300626F6F742E696D67

Taken from boot.img after lz4 decompression...

COMBINATION_FAC_FAR0_G991BXXU1AUA3_FAC_CL20796681_QB37484630_REV01_user_mid_noship_MULTI_CERT.tar.md5
[Android General] subevilx:
no so let me tell you what I want to do basically i just want to downgrade my s22 from u2 to u1 as there might be a oem unlock bug that I can use to unlock my device if it works ill share it otherwise it was all fun btw how did u manage to remove etoken verification
[Android General] adfree:
I have not removed eToken crap...

My stupid Bootloader sboot.bin ONLY checks text string...

If "he" find mrk text string... then I can flash with Odin...

If FACtory text string fac...

Then blocked... by sboot.bin Exynos Bootloader...

But again...

My Bootloader sboot.bin is unlocked... AND vbmeta.img is patched by Magisk...

Or you can do it manually... because only 1 Byte...

This is no Rocket Science to change text... from same size...

Also my GW4 SM-R870 and SM-R875F allows Bootloader downgrade...

So full Rollback is possible... including ALL files and partitions... with Odin + USB cable.

IMHO Phones especially modern Samsung Phones are better protected... so sboot.bin downgrade is maybe close to impossible... if full Knox crap activated...

Best Regards
[Android General] s0nlxaftrsh0ck:
Hey all, I've been trying this thing for a few days and made sure to download the current 1/20 bundle

I tried the following

Used the simple mode and get the blank screen and no prompt.

Tried doing it the manual way and was successful but still was met with a blank prompt when running

nc -lp 9997 in one terminal and am start -n com.samsung.SMT/.gui.DownloadList in one terminal and am start -n com.samsung.SMT/.gui.DownloadList in the other. I still get hung up...

I restarted USB and WiFi debugging and authorized both my laptop and wifi for USB debugging

Reinstalled lang.poc

Tried to set my wifi to STATIC and IP Address 192.168.2.225

Followed the instructions and made sure CHMOD 777 on adb shell /data/local/tmp/samsungTTSVULN2.apk

I was hoping I can get into system to make a full backup of some Apps on my phone particuarly Dragalia Lost 11GB folder. Would I be able to do that with this?

Phone is S22U bought from Samsung direct with T-Mobile SIM if that helps any
[Android General] subevilx:
I tried this i was able to flash my boot.img and recovery but i got stuck on download mode then decided to do it for the whole file then I started getting secure boot fail for all files except boot and recovery i did this on a combination file any way to fix secure check?
[Android General] adfree:
@subevilx

Now we come closer to Rocket Science... because damn Crypto...

Other files also different secured... Minimum by Samsung signing stuff...

For instance I have no idea how to disable Security check in:

vbmeta_system.img

Similar to vbmeta.img... which holds Security info for boot.img and recovery.img

Then I could flash modified super.img... in theory...

Maybe somebody have an idea. As my Bootloader has no Fastboot Support...

Only FACtory sboot.bin has Fasboot...

Best Regards
[Android General] Moshe fasten:
Someone may have already asked this question: but with this exploit, is there a way to enable call recording without changing to a different CSC? and if so how?
[Android General] javadahut:
Confirmed, I have the same issue.

Android 13

Nov 2022 Security Patch

Default SMT system app v3.3.02.75
[Android General] mohitgalaxy3:
So trying to find how can i further improve network issues or find the difference between global and Korean model. Found that it doesn't support secondary 4G/LTE, though not sure the info is correct or not.
[Android General] Abish:
Actually I'm on dec 2021 patch 😅
[Android General] profi_fahrer:
Sadly, I can't get it working. It basicly stops after opening the two shells with the commands. The easy method is unable to access the needed DLLs, even with Windows Defender turned completly off.

Is the "K0mraids_POC.apk" supposed to show a blank screen on startup, or should it load something else?
[Android General] adfree:
Somebody forked... whatever this means... and created exploit.sh...

Ehmmm... I am tooo blind to find this Shell Script.

Can somebody please help to find this?

Thanx in advance.

Best Regards

Edit 1.

Oh great... EXE AND Avira crashed on my old Notebook...

Edit 2.

The good news... for me.

SM-R860 tested also with "new" Firmware GWA3 successfully.

Notify Update

"""Security crap""" from January 2023...

So in theory also working for GW5... but here nobody confirmed yet...
[Android General] mohitgalaxy3:
@wr3cckl3ss1

I was wondering if the exploit can enable the cross flashing somehow. Like can we change model no for SM-G998N single sim to accept SM-G998B australian single sim firmware.

For example U and U1 can do cross flash.
[Android General] subevilx:
I cant go beyond this if I change even one bit in a file im stuck on file analysis any help?
[Android General] mauricio1352:
is there any way to contact you? I have an A71 with KG LOCKED, it would be interesting to test some commands on it, to see if I can get KG COMPLETED, just like yours🙂
[Android General] Tofor:
sorry to bust in here and ask something somewhat off subject. But i was curious how you got the cmds for opening the hidden menus? What do all the numbers at the end stand for? I'm asking because there has always been something that has come up in my list of secret codes for samsung. near the end of the list there comes some secret codes that are in all caps letters. one such code that is on all my unlockable devices is *#UNLOCKKERNEL#. its part of the IOT hidden menu. but i cant find any such option inside the hidden menu itself. Curious if it could be executed the same way as you did for the other parts of the IOT Hidden Menu. to me. unlock kernel will either unlock the bootloader. or it will make the kernel debuggable. either would be awesome. Thanks for any light you can shed on this secret code.
[Android General] Tofor:
note. this secret code did not appear on my device until i used the system shell to enable the hidden menus
[Android General] v3r@:
https://github.com/flankerhqd/vendor-android-cves/tree/master/SMT-CVE-2019-16253 is this the same?