[Verizon Samsung Galaxy S 4] jb881122:
Recently, I found a way to exploit the bootloader on my Samsung Galaxy S III Mini (SM-G730A) to boot custom ROMs. As it turns out, the locked S4 variants are vulnerable to this too. That was excuse enough for me to part with $20 and give this phone a shot. Although I have an unlocked variant, I am able to chainload the locked bootloaders and test that they're able to boot custom images (I attached a screenshot of what CPU-Z looks like after doing this).

For more details on the exploit itself and how it works, see this thread.

Prerequisites​

A rooted SCH-I545 or SGH-I337 phone

An ADB connection to the phone (you should be able to run "su" within an ADB shell)

A non-Loki'd custom recovery image (like the 3.5.0 image at this link, later versions are 9.8-9.9 MB in size and will likely result in a "too large" error)

A custom ROM to flash (like LineageOS 18.1 or this LineageOS 19.1-based ROM)

Steps​

I assume you know what you are doing. I am not responsible for bricks or anything else that might come from performing this procedure either correctly or incorrectly. Replace "/path/to/recovery.img" and "/path/to/boot.img" with the actual paths/file names of your recovery/boot images. If you are using a cmd.exe shell on Windows, some of these commands will need to be modified to fit the differing syntax.

Download the latest release of the bootloader exploit

Extract it somewhere where it can be ran

Open a command-line shell with ADB in your PATH and the working directory where the `oor` executable is located

Connect the phone to your computer if you haven't already

Extract your bootloader by running the following commands:

adb shell "su -c 'dd if=/dev/block/platform/msm_sdcc.1/by-name/aboot of=/data/local/tmp/aboot.img'"
adb shell "su -c 'chmod 644 /data/local/tmp/aboot.img'"
adb pull //data/local/tmp/aboot.img

Patch your recovery image by running the following command:

./oor -p aboot.img /path/to/recovery.img recovery-patched.img

You might get one of several different messages:

Success: Good, move on to the next step.

Output image too large: Try a smaller recovery image. Alternatively, you might be able to flash the unmodified recovery to a different partition and use oor -r to create an image to flash to the recovery partition, but I'll leave doing that up to you.

Unsupported bootloader: Either PM me your aboot.img file or post it in this thread. I can look at it and add support if it's vulnerable (which it likely is if it came from an I545 or I337).

Flash the recovery image by running the following commands:

adb push recovery-patched.img //data/local/tmp/
adb shell "su -c 'dd if=/data/local/tmp/recovery-patched.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery'"

Reboot to recovery: adb reboot recovery

If all went well, you should now boot into a custom recovery.

Wipe Data/Factory Reset

Install or sideload the ROM zip file as one would usually do

Extract boot.img from the zip file

Patch the boot image by running the following command:

./oor -p aboot.img /path/to/boot.img boot-patched.img

Flash boot-patched.img either in TWRP's interface (installing as a boot image) or by running the following commands:

adb push boot-patched.img //tmp/
adb shell "dd if=/tmp/boot-patched.img of=/dev/block/platform/msm_sdcc.1/by-name/boot"

Reboot to system

If all went well, you should now boot into your desired custom ROM.

Steps 6-7 will need to be repeated every time you want to update the recovery while steps 11-13 will need to be repeated every time a new ROM is installed or modifications (e.g. Magisk) are made to the boot image.

Hope this helps! As my experiences with the SM-G730A have shown me, it sucks to have a locked device, but it's far from the end of the world.