yashsingh1/xdaforums huggingface dataset:
[Introductions] Doug.S:
Hello everyone. Thank you for the time to here for me to say little about me. My name is Doug.S, and due my inability to not attempt to make something better that isn't broken and had nothing to start with, . I am not sure if I bricked my Samsung S10t SM-G975W, or if its hardware problem or fact that I can barely get enter the right command in P.Shell to find devices. I know there are already a lot of threads here that are about the same, I think it's the same issue anyways. I cannot turn it off to reboot it or anything. When it is, I can only see a very dim and dark to bright red screen. Sometimes there is a "5 page talkbalk tutorial that turns on with certain button pushes- to help you learn how to navigate and operate a device that has very little to no display and that people have difficulty navigating" Those are the introductionwords from the talk back, at first I thought it was virus or something along those lines but i am convinced that it is the SS RDX reset watch dog security I tripped when I tried to flash it with the original firmware using Odin 3 v3.13b patched. Everytime I try with Odin now it shows complete write fail, most of the time Odin fails to connect as the program freezes and gets stuck when i select either the ap or csc or after selecting both Odin ends up Not Responding. One of the fails was unable to open selected file line 604. I have tried using the Sam tool, I got the original firmware from there, but the tool usually shows fail to connect or says no adb. Fails to reset or remove lock or anything else I've tried with their tool. Twice Samtool displayed success after flashing but there was no change other than to show the info of the installed firmware on the phone. I have tried with great trepidation to Nand erase and repartition it after researching and reading lots of articles that I found in google search, but have had no luck. And the Smart Switch i have for my back up either says failed to connect or it says connected device does not allow for USB file transfer. I apologize for such a long introduction. I would truly appreciate any ideas or advice.
[Touch Pro, Fuze General] tursoke:
I was installing my invisibleSHIELD last night with my phone turned off, and apparently managed to do something while trying to fiddle it on as the screen turned on with some small amount of data, and it was colored like some color test screen, red blue green and white horizontal areas(or something like that).

So what did I manage to do? Was it dangerous in anyway for the phone? Probably not, but I'd like to know how I did it and what's its purpose =)
[Touch Pro, Fuze General] Scrtcwlvl:
This is called the bootloader screen (popularly known as the Tri-colour screen), you got to this screen by starting up the phone with the Volume Down button held.

Not dangerous at all, unless you had a RAPHIMG.nbh file on the root directory of your fat32 formatted storage card

[along with a wrapper] (Having that file in the root and starting up to the bootloader would allow one to initiated a flash)

This mode is used to flash a new rom, radio or spl to the device, either run to it automatically by a Wrapper from your computer or forced by the user. From this screen one can even flash any of those items from a storage card instead of from the computer. (I do this from time to time when I dont have access to a computer with active sync and wish to flash a rom.

Of course, one needs hard spl to flash anything custom.
[Introductions] OoZioo:
Hello,

I had the opportunity to buy an OP12 in China and I did it!

I am now keen to learn about flashing an OS ahaha!

Happy to join this community!

I start my Chinese mobil phone journey with a Huawei ascend mate 7 gold 🥇.

So I currently have a OP7T, a Xiaomi 10T Pro, a brand new Chinese OP12!

Side note, I can have access to someone who can have a Chinese number, can speak Chinese, etc if required.

See you around!
[Google Pixel 7 Pro] mishka1984:
Hello everyone! I want to start by thanking you all for being such a great resource to myself and so many others over the years. So yeah... THANK YOU!

Moving on...

I own a Pixel 7Pro. I unfortunately purchased it from Verizon as I was totally unaware of the long standing OEM Bootloader Unlock fiasco.

For once however, that is not what this post is about....

I am hoping that some folks with rooted Pixel devices might be willing to send me a copy of the citadel firmware ROM from their phone. It would be nice to have a few different versions and I will help you retrieve it out of the phone if needed.

I will be reversing the code the Google has promised to open source yet repeatedly failed to deliver on as well as profiling and attempting to document to chip's behavior as best that I can.

If anyone might help me out I woudl greatly appreciate it. I unfortunately cannot pull the files off of the phone I own which is very frustrating to say the least.

Please reply or private message me to respond.

Edit: I believe I have found some of the image files I am looking for in the driver releases here: https://developers.google.com/android/drivers
[Google Pixel 7 Pro] Locoman_:
What is the "citadel firmware ROM"? Asking from a stock rooted A14 on pixel 7p.
[Google Pixel 7 Pro] mishka1984:
Starting with the Pixel 3, Google began using a new new hardware backed solution for the most security sensitive needs of the OS. While several vendors had utilized silicon to fulfill similar needs, Google went all out and engineered a custom SoC (System on Chip) that lives separately from the main SoC and hardware further hardening it and narrowing its attack surface from rogue code running in the system. The chip is the Titan M and codenamed citadel. It interfaces with Android and communicates it services through a hardware bus (SPI). The services it provides are things like providing hardware based key generation and storage (StrongBox), secure boot services (Verified Boot), it integrates directly with the Insider Attack Resistance security module that protects the firmware from modification....

In other words it is a really cool piece of hardware that can really make life miserable for a person like myself that mistakenly bought his $1000 phone from the wrong carrier.....

Citadel runs its own Operating System based on EC (Embedded Controller) that Google originally developed for their chromebook work. As such it has its own firmware that google creates and distributes.

I have found where they release the files in their driver updates but I do not really know how they actually look once they are flashed into the system.

I'll be attempting to do my discovery in emulation in a similar manner to the guys at QuarksLab are doing their work with the chip. I will be using Ghidra to reverse engineer the firmware.

I am at the final stages of assembling the last pieces of my toolchain and just beginning to plan how to go about all of this. If you dont mind I will reach out to you in a week or so to get the code from your device if it turns out that the firmware files distributed by google are not complete (binary patch files for instance) or are overlayed in an obscure or particular way that would make using dd to carve the image out of a running system necessary.

Our phone model (the 7/ 7Pro) actually runs the Titan M2 btw.

https://www.securityweek.com/critical-vulnerability-googles-titan-m-chip-earns-researchers-75000/

Google’s Pixel 7 Packs a Beefed-Up Security Chip

The company says it hardened the security of its new flagship phones—and plans to release a built-in Android VPN.

www.wired.com

How Google's Titan M chip makes the Pixel 3 its most secure phone ever

Google has outlined the Pixel 3's Titan M chip in a recent blog post, explaining how the hardware makes the new flagship its most secure smartphone ever.

www.androidauthority.com

Attacking Titan M with Only One Byte

Following our presentation at Black Hat USA, in this blog post we provide some details on CVE-2022-20233, the latest vulnerability we found on Titan M, and how we exploited it to obtain code execution on the chip.

blog.quarkslab.com
[Google Pixel 7 Pro] mishka1984:
Are you okay, man? Username checks out!
[Google Pixel 7 Pro] BunnyPig1:
All of this sounds very interesting. What would the end goal be in this?

I am not very good at this by enjoy reading about it. Could this lead to spoofing unlocked bootloader since this seems to be one of the cores in root of trust?
[Google Pixel 7 Pro] mishka1984:
Yeah... So that's the thing. It wouldnt be spoofing at all. Achieving code execution on the SoC essentially unlocks it all. The chip's job doesn't stop at just ensuring a secure boot environment. It acts as the root keymaster for the entire system. That keystore holds everyone who's using its secrets.... From users to carriers.

I don't know the LTE specs but it is not hard to imagine that a full takeover of the chip would even allow some wild **** go down given that the results of the APN connection setup key exchange would be stored there .

There could even potentially be the ability to eavesdrop and decrypt 4G and 5G data streams . I'm not certain on that. I just know that it's the keys that secure the communication and establish the channel but the signal is broadcasted to everyone within range.

So all this is to say that, yes. You can unlock the bootloader for sure that way. But the vulnerability would be so critical that you'd have to tell Google immediately so they could fix it.

OR I guess you could be like cellebrite in Israel is with iPhones and sell your exploits to governments...

https://cellebrite.com/en/home/
[Google Pixel 7 Pro] BunnyPig1:
Very interesting!

Would Google be able to patch any vulnerabilities found?

Let's say you (and others) would be able to Crack the Titan chip and take control over the data, and make a way to meet strong integrity (or hide root entirely). Would this be a permanent thing for all devices using the Titan chip or could they still implement something to prevent this huge safety risk?

("safety risk" for regular users, because I would love if I could just sign a contract with Google that say "I hereby acknowledge the risks of root and will never ask for help if something goes wrong, or if I lose all my data/money" so they could let me own my device haha)

I would help you if I ran stock. I sure hope you'll find someone that can provide with the information you need.
[Google Pixel 7 Pro] mishka1984:
Absolutely they can. But they have to know about it in order to fix it.

What youre describing is a persistent rootkit that has implanted itself into the firwmare. It's possible to program such devious persistence. But it would require A LOT of logic. Like recognizing when an OTA was attempting to overwrite itm injecting a copy of itself into the new OTA firware which invalidates the signature then lying to systemserver and friends that their integrity checks all passed as if nothing was up.

Highly unlikely and honestly scary thought. Heres a famous paper you should read by Ken Thompson one of the men who invvented the C programming language and UNIX on such an infector.

https://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

Google already sell unlocked phones and they are totally cool with you doing whatever you want to them.

I may end up being set with the binary blobs coming from google I will have to test and see :)
[Google Pixel 7 Pro] mishka1984:
For the time being... If anyone with a Pixel from version 4a up to current (8Pro?) running a ROOTED STOCK image of Android would be kind enough to send me the following files I would greatly appreciate it.

! * Copying these files will neither hurt your system nor disclose any of your personal information. I would appreciate it if you could please note your build number as well. I am happy to take the files from whatever Android release you may be running as I plan to generate binary diffs tracking firmware changes over releases.

Files:

* Contents (binaries) of /vendor/firmware/citadel

* The binary /vendor/bin/hw which is the citadel_updater oi you are curious
[Google Pixel 7 Pro] Locoman_:
Hey, I'll submit the files, again, I'm on rooted stock. Maybe clarify the files you want and also how to share with you.
[Google Pixel 7 Pro] mishka1984:
I truly appreciate it. Let me get to a computer and I'll message you
[Google Pixel 7 Pro] mishka1984:
Hi and thank you again. Im not saure what OS you use to connect to your phone with adb. I'll write a shell script to do this later tonight for LInux users and fight my way through a powershell script as soon as I get some downtiame.

but really I just need you to create a folder on your host machine then I believe you should be able to run:

adb root
adb pull -a /vendor/firmware/citadel /Local/Folder/citadel
adb pull -a /vendor/bin/hw /Local/Folder/hw

that should get the data needed. then if you are on Linux you can:

tar cvzf /path/to/folder

on windows I guess you right click the folder and "add to archive"

then attach the created folder_name to an email to:

EMAIL_REMOVED

with your build number. That will get me the firmware with intact BOOT ROM overlayed and the updater binary .

This script should work on Linux:

#!/bin/bash

cd /tmp

tmp_dir="citadel-fw_$(date +%F)"

mkdir "$tmp_dir" && echo "Created $tmp_dir"

cd ./$tmp_dir

adb root
adb pull -a /vendor/firmware/citadel ./citadel
# citadel is a directory btw
adb pull -a /vendor/bin/hw ./hw

cd ..
tar cvzf $tmp_dir

echo "$tmp_dir.tar.gz" created in /tmp"
echo "Please attach /tmp/$tmp_dir.tar.gz to an email containing your hw version"
echo "and build number and send to: mishka@1984@protonmail.com"

exit 0

it may be easier to do by hand. but if the script helps then there ya go :)

Thanks

Hopefully that make sense.
[Google Pixel 7 Pro] Locoman_:
Brother, that might be too much. I'd copy/paste but adb is too too.
[Google Pixel 7 Pro] mishka1984:
adb root

adb pull -a /vendor/firmware/citadel ./citadel

adb pull -a /vendor/bin/hw ./hw

These are the only commands that matter. I understand your reluctance to copy and paste. it just starts your server as root for the file access then copies then to the local machine. Whatever your comfortable with if you tell me your OS I'll write you a script and attach it so you just have to click it
[Google Pixel 7 Pro] simplepinoi177:
So I have a stock rooted P7P....while i did find the folder in my root explorer vendor/bin/hw, there was no vendor/firmware/citadel folder. There is a "citadeld" and "citadel_updater" file in the /vendor/bin/hw folder; if that makes any difference....
[Google Pixel 7 Pro] mishka1984:
Interesting. I would need the entire contents of /vendor/bin/hw I'll be reading the source code for the citadel_updater that lives there tomorrow.

So you don't see the /vendor/firmware/citadel folder at all? I have one on and I'm running a stock build of Android 14 on a pixel 7pro (UQ1A.240205.002.A1)

I'm looking into the /vendor/firmware/citadel issue. I have a feeling Magisk has done something like overlay it or not mounted it on boot. I'll get back to you. Thank you for the information

Edit to ask: is the /vendor/firmware folder present at all?
[Google Pixel 7 Pro] simplepinoi177:
confirmed.

But I am still on UQ1A.231205.015.A1 December firmware if that means anything -- hadn't had time or computer resources to update just yet. Also, I am on Magisk stable (but have yet to update to 27 and am still on 26.4); if that helps/means anything.

If/when I have time, I'll send you the dump of my /bin/hw folder...

hope these helps....
[Google Pixel 7 Pro] mishka1984:
Its incredibly helpful. Thank you! Let me dig around it's late here and my brain is moving slowly
[Google Pixel 7 Pro] mishka1984:
Morning everyone. I hope you will all understand that this is completely undocumented territory so I apologize that things are a little wild here.

We have two issue happen there. one is the migration of the root store being removed from the ROM and the switch to running system_as_root for AB slot booting.

With / now on system an entire ecosystem images and overlays has become involved in the construction of the filesystem's basic structure. ...

Thia is where vbmeta.img enters the scene. It is essentially a structure of offsets, sizes, and keys that are chained together in a way that the entire filesystem comes together from it's various parts in a cryptographically sane manner. Hence its name whiche stands for Verified Boot Metadata.

We also have the issue that in the Pixel 7 Google upgraded the SoC's to the Titan M2 and Tensor G2 Application Processor. This chipset has a new codename. "citadel* is depreciated in 7 and subsequent versions of the hardware. I'll clue you all in once I get caffeinated and logged in.

I will be writing code to unpack the vbmeta image and trace exactly what it's doing on our systems and. I will write scripts to make this as painless a process as possible.

Thank you all for you help. We're all learning this **** on the fly together!
[Google Pixel 7 Pro] mishka1984:
I just want to thatnk everyone for their assistance. with this. A user reached out to me and was able to send me the files that I needed for Pixel 7- 8Pro Titan M2

Now all I need are the files that I mentioned at first for the Titan M / citadel and I believe that I can find them in the driver releases.

Thanks again!
[Google Pixel 7 Pro] avid_droid:
Curious to see the end results as I'm a vzw pixel 7 pro aswell,sadly
[Google Pixel 7 Pro] Teflon_John69:
Hopefully you make the 2 FA key required when unlocking the device, it should definitely be an added security feature which I originally thought it was, then after buying the keys, I found out they are only used to access our Google Account :(.
[Samsung Galaxy S21 FE] ELENIUM115:
Is there a way to recover photos from phone samsung s21 after I forgot screen password? I have password to google, samsung account but not to the screen :(. In the past for my friend with similar situation I made factory reset, rooted phone then made mirror partion and finaly recovered photo this was few years ago. Now I read that this woudn't be possible because after factory reset I will lose a key and all the data on Android are encrypted with that key so I will find nothing after factory reset.

Anybody know any other method to recover photos? I'm only interested on photos.
[Samsung Galaxy S21 FE] Billabomb75:
Dont think it would be possible without root. Perhaps try and reboot into Recovery mode / Download mode and see if u can pull from the data partition. o
[Samsung Galaxy S21 FE] ELENIUM115:
How can I do it? I know how to set the phone into "download mode". But when I connect the phone to my computer via USB cable, ADB doesn't see it, and also fast boot doesn't see it. I already installed the Samsung Switch to get the newest driver, but that didn't help. This is probably because the phone doesn't have USB debugging option turned on.
[Samsung Galaxy A10 Guides, News, & Discussion] pico3:
Hello, my friends! Yesterday, while installing TWRP on my A10, I encountered the 'Error Validating Footer' issue after completing the flashing process. However, I managed to find a fix, and I'm eager to share it with you all.

Knowing that you have already unlocked your bootloader, you will need to have Odin open and TWRP in the 'AP' slot. Download vbmeta_disabled.tar from here. Then, place vbmeta_disabled.tar in the 'USERDATA' slot and click on the flash button.

If Odin is stuck on 'Setup Connection', you can try rebooting your device by pressing the Power Button and Volume Down simultaneously.

At this point, your device will reboot into TWRP, but our task is not yet complete. We now need to disable encryption. You can download the necessary file from here. If you haven't downloaded platform-tools yet, now is a good time to do so. Once platform-tools is downloaded, extract the files and place Disable_Dm-Verity_ForceEncrypt_10.28.2020.zip into the same folder where adb is located (\platform-tools_r34.0.5-windows\platform-tools). Then open a command prompt window and enter the command: `adb push Disable_Dm-Verity_ForceEncrypt_10.28.2020.zip ./sdcard`. Once the file is successfully pushed to the phone, go to 'Install' in TWRP, select 'Disable_Dm-Verity_ForceEncrypt_10.28.2020.zip', and swipe to install it. After the installation is complete, go to 'Wipe', tap on 'Format Data', and then type 'yes' to confirm.

Congratulations! You are now a pro developer (just kidding). You have successfully installed TWRP on the A10 without encountering 'Error Validating Footer' and disabled encryption as well. You are now free to install any custom ROM to your liking.

Credits:

@afaneh92 for providing the vbmeta_disabled.tar file.

@Topser99 for providing the Disable_Dm-Verity_ForceEncrypt_10.28.2020.zip file.
[Samsung Galaxy A10 Guides, News, & Discussion] pico3:
Support will go to this thread: https://xdaforums.com/t/recovery-of...exynos-series-sm-a105-4-january-2022.4212641/
[POCO M3 Questions & Answers] Danish on XDA:
title says it all i wanna overclock CPU and GPU and maybe the screen too...it feels slow now that there are no new roms for it
[Touch HD General] alexwai:
question regarding mms setting, i cant receive mms now, i dint disable it on the HD Tweak, any setting i need to set in order to receive the mms?

please advise..:)
[Touch HD General] CorruptedSanity:
Check to see if your operator has configured your device to recieve mms.

Cant you establish a connection with the internet to surf the web or update weather for example?

In this country, the operator has installs 2 connection types on our devices. A connection setting for sending/receiveing mms and another for the internet.
[ZTE nubia Z60 Ultra] Pascal536:
Good morning,

An update is available this morning, measuring 220.90 MB. It is version MyOS14.0.10MR2, from January 2024.

Sincerely
[Samsung Galaxy Tab S7 FE] :
Hello I am brand new to this website. Also brand new to rooting. I would like for someone to tell me what is the purpose of rooting and the benefits of it as well. I tried doing research but i just get tutorials how to do it. i need info on why do it and what apps are you then able to download. also i couldnt find my device here but what i haave is galaxy tab s7+ im not sure if Fe is same but ya.....
[Samsung Galaxy Tab S7 FE] lewmur:
No, the S7 + is NOT the same as the S7 FE. You will find the threads for the S7+ here. Just my opinion, but if you don't already know the benefits of rooting, don't do it. Once you've rooted you will no longer receive OTA updates on your tablet.
[Redmi 9A Questions & Answers] redmi9auserdebricked:
I accidentally hardbricked my Redmi 9a. I don't have a PC to use sp flash tool. I used another phone to unlock the bootloader and flash twrp recovery,iflash lineage os on my phone and I reboot it and it's not working anymore.

Please help 😭
[Redmi 9A Questions & Answers] mvikrant97:
Without PC nothing can be done to unbrick.
[Redmi 9A Questions & Answers] redmi9auserdebricked:
Maybe it's time to say goodbye 😭
[Redmi 9A Questions & Answers] silver.soul7:
no bro borrow a friends pc and try this it worked for me

[How to guide] Redmi 9A [Dandelion] - Flashing with SP Flash Tool in BROM mode.

[How to guide] Redmi 9A [Dandelion] - Flashing with SP Flash Tool in BROM mode. 1.Please don't use Format all + Download in any circumstances in the SP Flash Tool. You have been warned! If you get any error while flashing or have any doubts...

xdaforums.com
[Redmi 9A Questions & Answers] redmi9auserdebricked:
I don't have friends that owns a pc
[Redmi 9A Questions & Answers] silver.soul7:
Then you gotta go to a service centre... usually in my place it costs around 300-1.5k (rupees)for flashing stock rom...
[Redmi 9A Questions & Answers] redmi9auserdebricked:
Maybe it's not worth it to go to the service centre, if I can borrow my cousin's laptop and then no money needed.
[Redmi 9A Questions & Answers] redmi9auserdebricked:
Maybe someone can make sp flash tool for Android devices.
[Redmi 9A Questions & Answers] silver.soul7:
I doubt that will happen anyway soon 😐...
[Redmi 9A Questions & Answers] silver.soul7:
Any chance you from Kerala?...if so I could help you out 🤔
[Redmi 9A Questions & Answers] Alexander92013:
hey use a edl mode