yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] globalnet626:
I caught up with the thread and it's probably unlikely but just in case - Bootloader T290XXS5CWG3 still doesn't work right? I had received this tablet from our work ewaste bin and it's just a bit too slow on the stock OS to be usable...
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] lifehackerhansol:
Yes. That has bootloader revision 5. Only 3 works at this time.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] tahasmarty:
So no Luck for binary 5 bootloader users? :(
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Can we Use this new out of bounds write vulnerability already present in all un-updated Samsung Android 11 devices 's bootloaders to trigger heap overflow and stack based buffer overflow in the bootloaders of this Samsung Galaxy Tab A8 2019 SM-T290 which is also still on android 11 (which is beneficial as this means vulnerability is present for us to attack) to authorize booting of custom TWRP recovery and Magisk boot images from the newer nonsensical bootloader versions S4, S5 and S6 on SM-T290 ? Also, dont update further permanently as if any hope is there then its available at the time of this writing, at the time of this vulnerability news. If you update further then the little hope we have will also be lost. I also welcome everyone to please support and help this device SM-T290 as this is a very descent device only to be worsened by Samsung's own updates.

Thank you,

Waiting for anyone's support
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] lifehackerhansol:
So pjt

Note: the vuln is CVE-2023-42561

The CVE is unfortunately not very descriptive (not that it needs to be to get a CVE, but sometimes it has a few)

Version 5 bootloaders are probably vulnerable as well, but looking into it would be like finding a grain of sand in the haystack...

It's also possible it only applies to Samsung's new devices that use abl instead of aboot (we use aboot), or Exynos bootloaders... hard to tell.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
True. Version 5 bootloaders or S5 bootloaders are also vulnerable confirmed as I got the S5 update before December 2023 and Samsung for the 1st time introduced the S5 update only in Brazil around October or before of 2023. But the bug ws found and publicly announced on December 15th,2023 by CERT-IN. So yes, we are safe to say this and have an advantage here to attack the S5 bootloader too.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
I actually got many descriptions. Should have searched more I guess. Link :

CWE -	CWE-787: Out-of-bounds Write (4.15)

Common Weakness Enumeration (CWE) is a list of software weaknesses.

cwe.mitre.org

NVD - CVE-2023-42561

nvd.nist.gov

Samsung Mobile Security

security.samsungmobile.com

CVE Website

www.cve.org

Product Security Update | Support | Samsung Semiconductor Global

Samsung semiconductor values product security. Check out the latest product security update at Samsung Semiconductor Global.

semiconductor.samsung.com

Please tell me if it is helpful or should i provide more info
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Can this boot kernal tagged as magisk kernel for binary 5 for t290 help ?

T290 U5 Android 11 ROOT (T290XXS5CWG2)[MAGISK 25.2].tar | Halab Tech Support

support.halabtech.com
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] lifehackerhansol:
The problem is the same. It tells us that a heap overflow exists, but where, and how?

Typically a CVE won't need to be descriptive, it just needs to say something exists. Sometimes you're lucky, and you see more interesting details. This one isn't one of them, and Samsung certainly wouldn't want to describe it any further.

I do have a second T290, but it's on binary 4 and I don't really think it's a good idea to update to check what it does. Maybe someone else can?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
I updated and tried the s5 Magisk boot image but its showing the same error of "SECURE CHECK FAILED : BOOT.IMG"
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
I requested for binary version 5 / S5 source code for Samsung T290 Tab and they provided here at https://opensource.samsung.com/ :

SM-T290	T290UES5CWG5	SM-T290_NA_RR_Opensource.zip

Is this helpful for upgrading to TWRP recovery or Magisk ? I am excited so reply soon
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] lifehackerhansol:
The bootloader is closed source. Typically only GPL-licensed code gets released here, and the bootloader (LittleKernel) is MIT.

Well, it's probably useful for ROM dev otherwise I guess.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
This guide is helpful in using buffer flow exploit for SM-T290. Is someone getting something in this which I am not undertanding ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Breaking the Android Bootloader on the Qualcomm Snapdragon 660 | Pen Test Partners

This post is a companion to the DEF CON 29 video available here. A few months ago I purchased an Android phone to do some research around a specific series of NFC chips, which required me to gain root access to the device in order to fully access its hardware capabilities. Gaining root access on

www.pentestpartners.com
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] temporarium:
Spoiler content hidden.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Its known. I did not pin the article for just copying the steps but for deriving new info suitable for our circumstance. Thanks for pointing still.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Spasmojo:
Hello guys,

Im new in LineageOS. I bought a SM-T290 was in android 10. I upgrade to Android 11 T290XXU3CVG3 version.

I followed the 5 first step of the lineageos guide to unlock OEM and everything worked well, OEM seems to be unblock.

Then I followed the steps 6-13, to also unlock OEM ??? But at step 13 I have a black screen, and on the lineage guide there is a message: "Warning: If, on this step, your device is stuck on a black screen, your device’s bootloader is not unlockable and you cannot continue with these instructions"

Is there any reason why my tablet could not be bootloader unlockable ? There is nothing to do do unlock the bootloader ?

Thanks in advance,
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] lifehackerhansol:
SM-T290's bootloader unlock works like this:

- Unlock bootloader

- Downgrade the bootloader to the very first version released by Samsung, because this is the only one that lets you flash a custom recovery and ROM

Now, the issue is that there are two types of SM-T290:

- First revision, launched with Android 9

- Second revision, launched with Android 10

It seems the old bootloader only works on tablets that launched with Android 9, but has black screen issues on tablets that launched with Android 10. We don't know the specifics of what's not working, but at first glance, it seems to only be the display. Hence, at this moment you won't be able to do anything.

Don't update your device still! This may be possible to fix in the future on custom recovery/ROM! If you upgrade stock ROM any further, you won't get custom ROMs ever!

Someone posted an unofficial tutorial somewhere in this thread on how to make it work on these Android 10-based SM-T290 devices. I don't know if it works, but it's likely your best bet.

I do have a few ideas on how to fix the black screen issues, but I need to investigate a bit further.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Spasmojo:
Thanks for your answer.

I think I understood with your explanations.

I will try to look for the unofficial tutorial tomorrow.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Spasmojo:
Hi,

I just saw you followed successfully this tutorial : https://xdaforums.com/t/flash-gsi-on-t290-with-twrp-blackscreen.4627759/

The tutorial seems pretty clear but I have a question about this part : " now you are in download mode. flash stock aboot.mbn and recovery."

Can you tell me how to get these 2 files please ?

Thanks in advance
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Find it in your firmware zip you downloaded. You will get it there
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
How to externally resore emmc dump ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] echow2001:
take the chip off mount it on a computer over usb and use dd to write image. not simple but if the flash is already failing or you want upgrade storage it might be possible.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Spasmojo:
Thanks, I find them in my firmware zip.

But not so easy for a noob like me because in my firmware zip, I only have 5 *.tar.md5 files. But when I extracted AP***.tar.md5 and BL****.tar.md5 , I found aboot.mbn.lz4 and recovery.img. So I had to download LZ4 program to extract the aboot files, then I had my 2 files, aboot.mbn and recovery.img, but Can't flash with odin which not recognized them.

So the last step was to compress the 2 files in a tar extension (in my case with 7-zip) so that Odin can flash them.

Maybe it's easy for you, not for me. Or maybe It's possible to do the same but easier way ? :)

Any case, I get my T290 tablet working on Android 13 with GSI.

Next step, find a way to have lineageOS on it :)

@lifehackerhansol : I answered you on this topic : https://xdaforums.com/t/flash-gsi-on-t290-with-twrp-blackscreen.4627759/post-89261905
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
I do the same way. Also .LZ4 can be flashed directly in odin, I guess. Unfortunate for me I am stuck on S5 binary and can't downgrade to S3 on my T290. Sasquatch(Samsung) is destroying this tab intentionally 😟
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Thanks. Helpful as last resort
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] hkp935:
hello there , i have my tab sm-t295 with u5 bl .

could i install lineageos on it , I mean downgrade its bootloader
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] _nKo_:
Hello there, there was a long time I didn't post, but today I need your help. My mother gave me her old sm-t290 tab. I want to use it as an e-reader. I looked for installing a light clean ROM as LOS on it to give more free space (no bloatware). I succeed in unlocking OEM but I can't flash any recovery on it. I've seen that I probably have a too new firmware/bootloader. I'm looking for a way to downgrade, but can't find one working. Any idea ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] lifehackerhansol:
Your version is too new. It doesn't allow downgrading to the one that works. Sorry.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Everyone stuck with the same Samsung destruction
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] _nKo_:
Well, that's what I presume. I can't blame my 73 years old mother who updated her device 🤣
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Argonon:
Thank You!!! Latest Nightly is working great!
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Pittonecio:
Thanks, I just managed to install it after repeatedly failing to boot into lineage recovery (had to flash twrp instead) and I must say it really feels like a new device, it runs extremely fast compared to stock.

So far I have only found 1 major issue, the option to enable double tap for wake up is missing, you can only enable double tap for sleep, those are my most used gestures to extend the life time of the power button.

Is there a particular reason for it to be missing in this device (I have 2 phones running Lineage os, works on both of them) or is there a different way to enable it?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] traman124:
I just bought a T290 for an IoT project and decided to install LOS. Luckily enough for me, it came with BL V3 and Android 10 so I flashed A13 on it - it's great, works better than A10 did. Thanks so much for this ROM @lifehackerhansol
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Argonon:
Just got my first OTA! 20-20240117-NIGHTLY-gtowifi! It installed fine. I had TWRP installed. Used button combo to get it in recovery mode and it updated by itself and even repatched boot with magisk delta. I had to reflash Samsung MultiDisabler zip.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mmmbn:
Is there a tutorial (with pictures or a video) avaible somwhere? Thanks ind advance for your answer.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Guys saying that android 13 is working excellent/fast on sm-t290 is so tempting 🥺 and depressing 😨 for me at the same time that I never knew about the custom rom by @lifehackerhansol and couldn't try it before I upgraded to binary 4 (S4) just because I upgraded to it. HATE YOU SAMSUNG 😡🤬!!!
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mmmbn:
I bought my device used for a rather small price. Without possibility to flash a custom rom it is useless for me - I will simply not use it.

Hence, I am willing to take the risk and open it to flash an emmc dump onto it which was mentioned as an option here.

Unfortunately I am unable to find information that I need to give it a try, e.g.:

- where is the chip located?

- can it be taken of and remounted easily or im possible without soldering?

- which usb emmc flash devices to use?

- where to get an emmc dump?

- other helpful hints?

So, maybe I just sell it again or throw it away...
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Argonon:
Yes! This recent ota stopped a random reboot and is even more smooth! I can't complain period because I use kitsume canary magisk and various module like zygisk and lately care less about google and run degoogled to the best of my ability. Thanks to this Developer our old and easily obtainable, cheap priced devices have more years of service. LOS is pretty awesome.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Too bad I can never try this LineageOS now as on S4/S5 binary. Also I contacted Samsung on their developer forum reporting about their SM-T290 's bugged S4/S5 bootloader which is checking for images security even after unlocking it. Result was they deleted my post containing the report/request and also permanently blocked my samsung forum account and email along with my ip address, as being reported on trying to sign in on samsung's developers forum. Now I can never sign up using my main email id. This is very doubtful behaviour on their end and raises eyebrows. It seems Samsung intentionally blocked bootloader of SM-T290 which is their cheapest tablet till date, which points towards they forcing us to buy their expensive one and forget their cheaper devices. No expected from them. Shame on Samsung. Will never buy from them. Same advice to everyone who reads my message. Then only Samsung will learn a lesson
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Argonon:
Since its a kind of older device, look in to downgrading firmware
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Any lead ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] temporarium:
I'll just throw this out there:

What if someone made a dump of their older bootloader? Could this be sideload/odined over the newer one that can't be unlocked, etc.?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
No, it will not work.

Only the T290's firehose programmer file for QFIL tool can 100% save us, but I don't know which 3rd party can give it or sell it. Do you know someone who sells T290's firehose programmer file ? I know that the Samsung service centres always have those programmer files. If asked, they can provide the firehose programmer in exchange for money, if they want to ;).
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mr.lfrl990:
No, no no.

That has never been the problem. We can easily obtain the qdloader, and we don't need a dump either, because we only have to download the old firmware.

The problem is that once this is done and the old system is written in the emmc of our tablet, it will never turn on, since the system will refuse to load since the binary verification will fail.

Our only option is to fill all possible Samsung channels (social networks, forums, email, etc.) until they listen to us.

We could generate public pressure by taking our case to, for example, big technology YouTubers.

Not only can we, but we must, because if Samsung sees no major complaint about these dubious facts, they will start doing it on other devices. Today it is our tablet, tomorrow its new flagship.

Even if it's unintentional, and just ineptitude, we need to let them and the tech community at large know.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Absolutely true. We should keep these companies in check else they may do whatever.

I guess we will overwrite the bootloader aboot.mbn with the old one then why will it do binary verification ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
You said it not an issue, so Can you provide me the qd loader !? I will try to risk my tablet.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mr.lfrl990:
I do not think that the verification is only done in aboot, but that it is also a hardware-based verification, since even once the aboot is written with a system that has a lower binary, the system will not boot, but will go directly to Qualcomm HS-USB Diagnostics 900E (I tried). The solution of doing a brute force downgrade with test point is not feasible.

There are only 2 solutions to this.

a) Buy a motherboard with binary 1, 2 or 3.

b) Ask Samsung for a truly functional and unlockable bootloader

Even knowing that what you are trying to do is not possible, if you still want to get the loader, let me know. Anyway, this is an off topic, and I should create a new thread
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
I will be very grateful if you provide me the qd loader and its related files. I want to contribute to the community and make this tablet usable. Also, logically even though i own this tablet currently its so slow that its unusable for my work and so i seriously need to root and install twrp for it even though it gets bricked permanently, because I have no other use for it until it gets faster. Either my T290 gets better or its staying in dust which its already doing.

So, hoping for a positive change
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mmmbn:
Can you please elaborate a bit more on how a harware check can detect a downgrade?

So far I thought that bootloader refuses to be replaced with an older version?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] waver1967:
T290XXU3CUG4 bootloader , can i install your build ? i see you must be on T290XXU3CVG3 ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] 2faraway2:
Yes, U3-version should be ok .. you're a lucky one .. :)

If your device came with android 10, then you'll manage to unlock your bootloader, but you'll get a black screen while installing the rom or a custom recovery .. that's the less good part of the story ,,
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Minionguyjpro:
I agree we should stimulate and contact Samsung to make them fix this sh!t. Apple doesn't do a better job either (with their new rules for iOS in the EU). I am afraid though that this device is EoL, but not sure.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
True I support this. What shoould we do next then ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] waver1967:
succes . finaly... but what a @##@@ to get into custom recovery.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
No bro, not until we wreck havoc on Samsung itself by pressurising it or we hack the bootloader
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] Zekuzeyoshi:
Damn bro i waited many many years augh..
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] TuRkiShArmY:
System updates are bad...
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] phhusson:
For those lost on newer bootloaders, you can install GSI just fine (tested on T290XXS5CWG5).

Just edit stock vbmeta.img and set decimal offset 123 from 0x00 to 0x03, flash GSI, do factory reset and you're good. I've attached vbmeta.img for T290XXS5CWG5, but what I said can be done easily with any hex editor.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] temporarium:
Thank you @phhusson 👍🏻

I am on an older bootloader, so have been Lineage for a long time now.

But, what I appreciate is a guru helping out like this and making a statement in a publically-readable forum like XDA (and not on Telespam, etc.) for the benefit of all who search online.

Thank you, sir!
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
I love your work and this is a solution i was thirsting for. Can it be done for recovery and boot image too?:)
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] phhusson:
> Can it be done for recovery and boot image too?

I don't know. I gave it a quick try and failed, but I'm not really good on Samsung's boot.img generation.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] LUCID_DREE:
Thanks for replying. By the way how/where did you find the decimal offset bit caveat for t290 ?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] 2faraway2:
These are amazing news (y) , thanks a lot for your support for this device @phhusson :)

- Could someone describe the flashing steps with the patched vbmeta in a few words ?

- And with which GSIsi will it work ?

I think phhusson tested with his 'own' AOSP GSI(s) , but the GSI should fit into the system partition that's why I ask ...
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] phhusson:
> Thanks for replying. By the way how/where did you find the decimal offset bit caveat for t290 ?

It's the same for all Android devices. In usual GSI docs, you'll see `fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img` in the instructions. Since we don't have fastboot we can't do that. But what the `fastboot` command does on the computer when doing that is literally what I said: set 0x03 to offset decimal 123

> I think phhusson tested with his 'own' AOSP GSI(s) , but the GSI should fit into the system partition that's why I ask ...

Yeah that was https://github.com/TrebleDroid/treb...ci-20240208/system-td-arm64-ab-vanilla.img.xz

> - Could someone describe the flashing steps with the patched vbmeta in a few words ?

heimdall flash --SYSTEM system-td-arm64-ab-vanilla.img --VBMETA vbmeta-patched.img
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mmmbn:
Hi @phhusson,

I flashed exactly as described in post #494 and now I see an animated android (boot screen?) forever.... any hints will be greatly appreciated!

Thanks
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] phhusson:
Maybe do a factory reset from recovery? I think first boot on my friend's T290 was a bit long maybe 5-10 minutes.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] 2faraway2:
Success :)

Made short tests with phhusson's recommended img (it's a trebledroid AOSP Android 14 image) as well as with Andy Yan's LOS 20 (lineage-20.0-20240112-UNOFFICIAL-arm64_bvS-vndklite.img.xz), both fit into the system partition, both boot and work !

To install the GSIs without heimdall/linux you have to build a tar-archive with the GSI of your choice (as 'system.img.ext4') and phhusson's vbmeta (as 'vbmeta.img') , name the tar file however you like .. ;-)

Then get the device into download mode, flash the created tar file with odin (in the AP tab with unselected checkbox 'auto-reboot'), restart the device (press POWER + VOL DOWN approximately 5-7 sec) and get it into stock recovery mode immediately (hold POWER and VOL UP for a couple of seconds until you see the recovery screen).

There you'll have to do a factory reset and finally reboot into the system (which takes around 5 to 10 minutes until you see the rom's screen).

Never thought this will happen with T290XXS5CWG5 ... :love:

Update:

Small issue found in both GSIs: USB MTP protocoll seems to be broken .. but that's a perfect start for further tests ..