Database Develop

Signature Checks on Boot

Just so everyone is aware, the kernel and the recovery partition signatures are checked on each boot, changing those will leave you with a brick, until we have proper firmware to recovery with.
I found out the hard way.
On my second Atrix now.

Casualty of war

Taking one for the team

Well that sucks..
any free partitions that we can "steal"? and basically pull a haret where it loads partially from legit bootloader and kernel, then shuffles off to a different partition we CAN write for the real kernel, unloads all that other stuff and then launches the new kernel partiion we've modified?

designgears said:
Just so everyone is aware, the kernel and the recovery partition signatures are checked on each boot, changing those will leave you with a brick, until we have proper firmware to recovery with.
I found out the hard way.
On my second Atrix now.
Click to expand...
Click to collapse
I guess that when we told you this, you just had to find out for yourself. The recovery should only be checked when you attempt to access it, but the kernel is checked on every boot. I hope you did not return to store as defective.

DG, thank you for putting yourself out there, and putting together roms along with the dev work.
Its nice to see some progress being done along side all the people on here saying what we shouldnt be doing/trying with our phones.

Athailias said:
DG, thank you for putting yourself out there, and putting together roms along with the dev work.
Its nice to see some progress being done along side all the people on here saying what we shouldnt be doing/trying with our phones.
Click to expand...
Click to collapse
Don't thank him for repeating something which had been confirmed.

jimmydafish said:
I guess that when we told you this, you just had to find out for yourself. The recovery should only be checked when you attempt to access it, but the kernel is checked on every boot. I hope you did not return to store as defective.
Click to expand...
Click to collapse
So you told me it was checked every boot (first bold), but it should only be checked when you access it (second bold)? Confused, on drugs or what?
I just found out the hard way for you, it's checked every boot accessed or not.
If you want to be elitist and not post up a FAQ about what you know (do you even have an atrix), please stop posting in here, you've done nothing but spout off what you know about other moto devices, it is clear they tightened things down a bit more.
jimmypopulous said:
Don't thank him for repeating something which had been confirmed.
Click to expand...
Click to collapse
everything you guys say, along with others says it SHOULD be checked when accessed, which means I should have been able to boot normally and fail when I boot recovery.
You guys keep saying its CONFIRMED, where is it documented for the atrix. Tests performed with document results as proof.

designgears said:
So you told me it was checked every boot (first bold), but it should only be checked when you access it (second bold)? Confused, on drugs or what?
I just found out the hard way for you, it's checked every boot accessed or not.
If you want to be elitist and not post up a FAQ about what you know (do you even have an atrix), please stop posting in here, you've done nothing but spout off what you know about other moto devices, it is clear they tightened things down a bit more.
everything you guys say, along with others says it SHOULD be checked when accessed, which means I should have been able to boot normally and fail when I boot recovery.
You guys keep saying its CONFIRMED, where is it documented for the atrix. Tests performed with document results as proof.
Click to expand...
Click to collapse
What is being elitist by my statement? That before you started playing with your shiny new toy, we advised that doing certain things with your phone without proper firmware to restore your phone, WOULD result in a "soft brick".
I do not have a motorola ATRIX, never said I did, but I can read the firmware pretty well. If your offended by my post I assume it is because offered up my standard line of "hope you did not return it as defective", because nothing else in that statement should lead you behave like a child.
Here how about this for a Facts, my rom was the first to safely remove Blur from the Droid series of phones safely, after reading the firmware from your phone, and your deodexed version of the firmware there are many portions you could remove safely.
If you have questions you could ask and get the answers, but as it stands right now, we are just trying to help you save yourselves. Many people will enter these forums, and while each person is responsible for their own device, they will try to follow what you have done and they too will soft brick their phone. I'm not sure of your ethical and moral makeup but too many people return their manipulated device to the provider as defective causing every to pay for their mistake.
I just hope you bought another Atrix outright and did not scam ATT/Motorola.

designgears said:
So you told me it was checked every boot (first bold), but it should only be checked when you access it (second bold)? Confused, on drugs or what?
I just found out the hard way for you, it's checked every boot accessed or not.
If you want to be elitist and not post up a FAQ about what you know (do you even have an atrix), please stop posting in here, you've done nothing but spout off what you know about other moto devices, it is clear they tightened things down a bit more.
everything you guys say, along with others says it SHOULD be checked when accessed, which means I should have been able to boot normally and fail when I boot recovery.
Click to expand...
Click to collapse
DesignGears,
Please don't let a claim-to-know-it-all self-righteous Prick like jimmydafish discourage your efforts.
As far as I'm concerned (and probably the majority of people who mash the refresh button on this subforum multiple times a day would agree) it's people like you (people who have actively contributed to the users here at XDA in the past (all your captivate work)), that make me feel lucky to own the same type of device that you and other dedicated devs like yourself own.
Its hard to imagine how someone who probably played a very small part on a team -- a team that, as far as I can tell, has never managed to actually produce any real results on the DX -- can know so much about a device he doesn't even own.
And if reading this post encourages members of any such team to get their panties in a wad and start talking about how they are not going to contribute here now, well then to that I say: good riddance. For every one small tip you may provide it seams like you offer two holier-than-thou-doughe-bag-comments that frankly this section of this forum could do without.
But again, thank you DesginGears and Devs like you

mburris said:
DesignGears,
Please don't let a claim-to-know-it-all self-righteous Prick like jimmydafish discourage your efforts.
As far as I'm concerned (and probably the majority of people who mash the refresh button on this subforum multiple times a day would agree) it's people like you (people who have actively contributed to the users here at XDA in the past (all your captivate work)), that make me feel lucky to own the same type of device that you and other dedicated devs like yourself own.
Its hard to imagine how someone who probably played a very small part on a team -- a team that, as far as I can tell, has never managed to actually produce any real results on the DX -- can know so much about a device he doesn't even own.
And if reading this post encourages members of any such team to get their panties in a wad and start talking about how they are not going to contribute here now, well then to that I say: good riddance. For every one small tip you may provide it seams like you offer two holier-than-thou-doughe-bag-comments that frankly this section of this forum could do without.
But again, thank you DesginGears and Devs like you
Click to expand...
Click to collapse
I can assure you I am not, glad to have support.
--
Jimmy, no hard feelins, sorry I wanted try something and learn from it, sorry you told me two opposing things in the same post(this is what I am *****ing about if you would read you would know that), sorry I act like a child, I guess calling it how I see it is childish. From all the PM's about you I just got and mburris reply, you have made my block list, have fun in there with rafy.

jimmydafish said:
I just hope you bought another Atrix outright and did not scam ATT/Motorola.
Click to expand...
Click to collapse
Maybe if more people softbricked and returned phones that have locked down bootloaders, oems and carriers might finally realize that when someone buys a piece of technology, they own it, and would like to use it as such.
That includes:
1. Not having some POS skin on top of stock android (Blur)
2. Not being locked into paying twice for the data we already pay for (tethering)
3. Not being allowed to easily install non-market apps that we develop without jumping through hoops (slide loading)
4. Not having to wait for the carrier or oem mfg to release an update before we can have a current version of Android.
Call it a Brick-n-Return Protest

mburris said:
Maybe if more people softbricked and returned phones that have locked down bootloaders, oems and carriers might finally realize that when someone buys a piece of technology, they own it, and would like to use it as such.
That includes:
1. Not having some POS skin on top of stock android (Blur)
2. Not being locked into paying twice for the data we already pay for (tethering)
3. Not being allowed to easily install non-market apps that we develop without jumping through hoops (slide loading)
4. Not having to wait for the carrier or oem mfg to release an update before we can have a current version of Android.
Call it a Brick-n-Return Protest
Click to expand...
Click to collapse
LOL, that would surely cause some grief over at at&t, and a good laugh.
They would probably start leasing the phones so you can't say you own them.

Closed by OP request as this is an informational thread stating results of testing.

Ever seen a room full of developers get this excited before?

EDIT: Let's let the dev's have their fun without a bunch of newbs poking in on them. Sorry, devs.
Probably don't want this info to get out to the entire Internets anyways.

CZ Eddie said:
Hmmm..........
http://forum.xda-developers.com/showthread.php?p=51983540
No, you don't have root/unlock for ATT S5.
But...... hmmmm...
**** DO NOT POST IN THAT THREAD. IT IS A DEVELOPERS-ONLY THREAD. DON'T BE A DORK AND POST IN IT.
Click to expand...
Click to collapse
Pretty exciting. I am not a dev. so I dont really know how to distinguish between what exactly is going on, but a little progress and excitement is always good for the community. Not to mention the respect and bounty these devs will get once something major actually does happen.

EDIT: Let's let the dev's have their fun without a bunch of newbs poking in on them. Sorry, devs.
Probably don't want this info to get out to the entire Internets anyways.

CZ Eddie said:
Basically, evilpotatoman located a much-wanted Qualcomm tool that could possibly lead to finally unlocking the bootloader of S4, S5 and Note 3 (and others). *Possibly being the key word.
At the moment it's still not possible, but the tool apparently gives them a huge leap forward in development towards this goal.
They've been looking for something like this for a few years now I believe.
I'm not a dev, don't pretend to be one. The extent of my "development" is writing a few scripts. lol. So remember that I may be misunderstanding some things here. :good:
There are a bunch of files attached to the thread.
But none of us should bother downloading them because you have to be an ultra-dev to know how to use them.
Click to expand...
Click to collapse
My understanding i that this is the SDK for the SoC on the S5 and other phones. It includes a qualcomm dev signing cert but I'm almost 100% certain that no production phone from AT&T will accept BL's signed by the qc dev cert (or someone would have used it to sign one of the unlocked BL's by now plus if that were the case my guess is qc would be freaking out and sending takedown notices by now). So basically if Samsung or AT&T were to provide the signing key or somehow we were to brute force it(very unlikely) we would now be able to easily sign packages for the phone. So while helpful, without the signing keys it doesn't really do anything except provide more insight into how the whole secure boot process works.

http://forum.xda-developers.com/showthread.php?t=2692167&page=11

cciechad said:
My understanding i that this is the SDK for the SoC on the S5 and other phones. It includes a qualcomm dev signing cert but I'm almost 100% certain that no production phone from AT&T will accept BL's signed by the qc dev cert (or someone would have used it to sign one of the unlocked BL's by now plus if that were the case my guess is qc would be freaking out and sending takedown notices by now). So basically if Samsung or AT&T were to provide the signing key or somehow we were to brute force it(very unlikely) we would now be able to easily sign packages for the phone. So while helpful, without the signing keys it doesn't really do anything except provide more insight into how the whole secure boot process works.
Click to expand...
Click to collapse
Qc sent the takedown notice...dun dun duuunnn
Sent from my SAMSUNG-SM-G900A using Tapatalk

[TOOL][CyboLabs] Open Bump! Sign your boot images by yourself!

CyboLabs is Proud to present
Open Bump!​
What is Open Bump?
Open Bump is a recreation of the closed source Bump project run by Codefire.
It will allow you to "sign" your boot images in the same way that Codefire does it, only you don't need an internet connection.
Click to expand...
Click to collapse
What Open Bump is NOT
lets get the obvious out the way. It won't axe murder you.
It is not a direct reverse engineer of Codefire's implementation. I found the key and iv on my own
The magic bytes were taken from Codefire's method however. If anyone has insight has to how they were found, please shout up.
It does NOT take your private data so you can use it. Tin hatters feel free to double check
Click to expand...
Click to collapse
How did I find this out
I had a general idea of what to look for, having heard that the exploit is related uicc, and is signed with a cipher.
Dropping the aboot image in to Ghex led me to finding a reference to "uiccsecurity". Using the bytes around this, I found a repeat of 32 bytes, which was followed by 16 bytes which formed something that resembled "SecureWallpaper".
As you can probably guess, this was mainly trail and error backed by common sense and logical thinking.
you can programmatically find these values with the python script:
Python:
aboot_name = './aboot.img'
aboot = open(aboot_name, 'rb').read()
key_end = aboot.index('uicc')
key_start = key_end - 32
key = aboot[key_start:key_end]
sec_key_start = aboot.index(key, key_end)
iv_start = sec_key_start + 32
iv_end = iv_start + 16
iv = aboot[iv_start:iv_end]
deciphering some already generated "signatures" proved that these were the key and iv used for "signing" the images.
Click to expand...
Click to collapse
What is coming next?
Inspecting the signatures that were originally uploaded and the ones that people can generate now, I found only one pattern.
The only similarities were the first 16 bytes of each "signature". I believe that only the magic number is needed, and none of the garbage that follows. This has been confirmed by the LG G3 dev from CyanogenMod, Invisiblek Done
Click to expand...
Click to collapse
How to use it?
I don't know how well this will run on anything other than linux, so for now.. I won't talk about it.
First, ensure you are using python2
then run the script
Code:
python2 open_bump.py "/path/to/boot.img"
flash the output, and enjoy
Click to expand...
Click to collapse
Thanks to:
Obviously, this wouldn't have been possible without Codefire since I wouldn't have known where to look, or that it was exploitable. And it was them that found the magic key.
Big thank you to @pulser_g2, who offered invaluable input on cryptography
Big thank you to @invisiblek, who I mercilessly kanged the main part of the image padding script from
note:
The original part of finding this information out was done on my own with guidance from pulser. The final results of this are posted above.
XDA:DevDB Information
Open_Bump, Tool/Utility for the LG G2
Contributors
cybojenix
Source Code: https://github.com/CyboLabs/Open_Bump
Version Information
Status: Beta
Created 2014-11-23
Last Updated 2014-11-23

Thanks, thats great news to have an open source tool here!
Do you see any chance that this could be integrated into CWM/TWRP so that the recovery rom could bump the boot/recovery images before flashing?
Because the boot/recovery.img has to be extracted from the ROM-zip before flashing, bumping it here would make sure that the phone can boot the image even with the newer bootloader.
This would be great for rom-devs since they don't have to change anything and it would even bump roms that are not maintained anymore.

g4rb4g3 said:
Thanks, thats great news to have an open source tool here!
Do you see any chance that this could be integrated into CWM/TWRP so that the recovery rom could bump the boot/recovery images before flashing?
Because the boot/recovery.img has to be extracted from the ROM-zip before flashing, bumping it here would make sure that the phone can boot the image even with the newer bootloader.
This would be great for rom-devs since they don't have to change anything and it would even bump roms that are not maintained anymore.
Click to expand...
Click to collapse
simple answer, this can be added to the build step really easily. See this commit
edit:
of course it may be useful to make a c program to do this.... I shall think on it.

Propably stupid question but i ll give a shot. Since we have the magic key we cant just skip the bump stuff totally? As i can understand, i dont wait official developer team join the bump train, thats why the damn development of the device is really back while the hardware is more than capable.
**To the OP i wish i could give you a thousand likes sir!

After getting the bootloader may be open G3؟؟

Why not use the original Bump?
Quote:
Codefire has been extremely vague about their method, obviously to prevent someone else replicating their results.
They are also storing people's data unnecessarily, and even adding some information relating to the user in to the "signature", possibly for tracking purposes.
As a result of it being an external service, many reputable teams (which won't be named unless they want to be) have said they will not use it, and would rather wait till LG releases the official unlock method.
Finally, Codefire have said the sha1sum of the boot image is required. Whether they knew or not, it is NOT required, and I will be changing this tool to compensate for that.
Click to expand...
Click to collapse
Happy you found a new exploit for us builders and devs, just feel like you kinda disrespected codefire team by accusing them of things before actually talking to them, seems a bit counter productive, this may piss them off and next device you can kiss new exploits by them good-bye,
just my 2 cents on the matter,
i'd remove the line...
in any case thank you very much, i will add it to my build script
---------- Post added at 08:34 PM ---------- Previous post was at 08:29 PM ----------
nikosblade said:
Propably stupid question but i ll give a shot. Since we have the magic key we cant just skip the bump stuff totally? As i can understand, i dont wait official developer team join the bump train, thats why the damn development of the device is really back while the hardware is more than capable.
**To the OP i wish i could give you a thousand likes sir!
Click to expand...
Click to collapse
"Bump stuff" has nothing to do with users, the devs and builders do the "bumping", and development of the G series has nothing to do with bumping, it just takes time to bring everything up

Good job cybojenix. (moderator edit: watch your language please)
Way to ruin a good thing.
I'm done with Android now. You can do it all now - since you obviously know better than me and everyone else.
I don't appreciate people trying to blackmail me - EnderBlue and Cybo both.
Don't believe me? http://hastebin.com/gulumezawi.txt
Good job guys. Way to ruin unlocks for all future LG phones.
If I *EVER* decide to come back, I will not be releasing anything as free or open source. You've sullied my impression of the open source community. Anything I do will be private releases from now on.
LG hadn't patched Bump, and they were going to leave it alone for us as long as we kept it as a service.
Well, looks like that's over and done with.
Bump included a hash of the image that you uploaded and a hash of your developer ID, and some random junk bytes. That's all. It's exactly what we said it was doing.
Well, hey, now you're free to take over and write roots and unlocks for all LG phones since you obviously have the talent to do so.
Let's be honest though, without my team's hard work that you stole, you wouldn't have been able to do any of this.
But you knew that, you're just a bottom feeder.
I don't get angry often at all- but congrats! You've succeeded in making me mad! Achievement unlocked!
I'm done. Your turn.
EDIT: Also, you know you can't open source your project either considering it contains 'stolen' LG crypto keys. https://github.com/CyboLabs/Open_Bump/issues/1
Have fun with that one.

thecubed said:
Good job cybojenix. (moderator edit: watch your language please)
Way to ruin a good thing.
I'm done with Android now. You can do it all now - since you obviously know better than me and everyone else.
I don't appreciate people trying to blackmail me - EnderBlue and Cybo both.
Don't believe me? http://hastebin.com/gulumezawi.txt
Good job guys. Way to ruin unlocks for all future LG phones.
If I *EVER* decide to come back, I will not be releasing anything as free or open source. You've sullied my impression of the open source community. Anything I do will be private releases from now on.
LG hadn't patched Bump, and they were going to leave it alone for us as long as we kept it as a service.
Well, looks like that's over and done with.
Bump included a hash of the image that you uploaded and a hash of your developer ID, and some random junk bytes. That's all. It's exactly what we said it was doing.
Well, hey, now you're free to take over and write roots and unlocks for all LG phones since you obviously have the talent to do so.
Let's be honest though, without my team's hard work that you stole, you wouldn't have been able to do any of this.
But you knew that, you're just a bottom feeder.
I don't get angry often at all- but congrats! You've succeeded in making me mad! Achievement unlocked!
I'm done. Your turn.
EDIT: Also, you know you can't open source your project either considering it contains 'stolen' LG crypto keys. https://github.com/CyboLabs/Open_Bump/issues/1
Have fun with that one.
Click to expand...
Click to collapse
First off, I didn't black mail. I gave your team notice about open sourcing it after reverse engineering the LG bootloader, not your "signatures".
It's your choice if you want to leave Android. Pinning the blame on me is somewhat childish though.
LG not patching Bump? That's a ludicrous statement, and even if it's true, it's good that this script got released. That way they know it should be patched, since having it a service clearly makes all the difference to them.
The hardest part of your teams work was getting the keys. If you know where to look, then it's easy enough to get engineering builds which I suspect contain the master magic bytes which you released.
I'm honestly shocked at your reaction though. I gave your team all the credit and stated which parts I did myself. The part about the service, and the deception was justified.
You tried to obscure something which by logic can't be obscured. That's how so many people realised they can just append the bytes to the image.
So which one would you rather have, LG not patching the exploit (as you so claim), and having an unknown number of people in china running around flashing custom boot images, or have everyone know how to do it to force LG to recheck their security measures.
What I did may not have been fantastic for the community, but what you did was insanely dangerous for the 90% of LG users.

All you did was make it so LG locks down the bootloader. And really 90% of users??? There probably isn't even 3 percent of the LG base on this website. All you did was screw everybody else over so you could have YOUR OFFICIAL CM.
As well people saying you didn't do enough and are still using there signing key as well as attacking it as well.
Way to think about yourself. You didn't care about the 90% or you wouldn't have done this.
I personally hope LG locks down the bootloader now. Go the way Samsung did and put an efuse on it and prevent downgrading. Hopefully all this happens with lollipop so you can screw over the rest of the LG crowd.

cybojenix said:
it's good that this script got released. That way they know it should be patched, since having it a service clearly makes all the difference to them.
Click to expand...
Click to collapse
"Hey let's potentially close all future LG unlocks and thus the chance to use CyanogenMod on future LG devices then. Just so I can get the current CM builds to say 'Official' and get a big pat on the back from the CM dudes who probably don't care about me too much."
Is that what went through your mind? That instant gratification and ignorance really shows who you are because that's exactly what I see from this OP of yours. Enjoy your 15 minutes of fame. You probably just killed a chance for years of it.

savoca said:
"Hey let's potentially close all future LG unlocks and thus the chance to use CyanogenMod on future LG devices then. Just so I can get the current CM builds to say 'Official' and get a big pat on the back from the CM dudes who probably don't care about me too much."
Is that what went through your mind? That instant gratification and ignorance really shows who you are because that's exactly what I see from this OP of yours. Enjoy your 15 minutes of fame. You probably just killed a chance for years of it.
Click to expand...
Click to collapse
Yes, because I've been such a massive supporter of cm. (sarcasm in case you didn't realise).
I started reverse engineering the bootloader for research purposes. If it was more complex than what I have said above, then I probably wouldn't have done this thread.
If it weren't for the fact that the magic stays the same across all signatures, then I also wouldn't have done this thread.
The response I got from them when I contacted them before releasing this was pretty much one of lack of care. So I went ahead and posted it.
I couldn't care less about fame. In fact there isn't really a lot I do care about, but I won't have the community alienated in to thinking the codefire service was such a great thing.
And once again, I refuse to take the blame for their team leaving Android.

whoppe862005 said:
All you did was make it so LG locks down the bootloader. And really 90% of users??? There probably isn't even 3 percent of the LG base on this website. All you did was screw everybody else over so you could have YOUR OFFICIAL CM.
As well people saying you didn't do enough and are still using there signing key as well as attacking it as well.
Way to think about yourself. You didn't care about the 90% or you wouldn't have done this.
I personally hope LG locks down the bootloader now. Go the way Samsung did and put an efuse on it and prevent downgrading. Hopefully all this happens with lollipop so you can screw over the rest of the LG crowd.
Click to expand...
Click to collapse
See my other post, I don't care about cm.
Fair enough, 3% are here, so this benefits the security of 97% of lg uses, if the claim that lg was alright with it running s a service is true.
Either way, I did nothing wrong

cybojenix said:
I couldn't care less about fame. In fact there isn't really a lot I do care about, but I won't have the community alienated in to thinking the codefire service was such a great thing.
Click to expand...
Click to collapse
So you only care about ruining good things, and other people's work?
Lol sorry I think I'm done with you. By cybo

savoca said:
So you only care about ruining good things, and other people's work?
Lol sorry I think I'm done with you. By cybo
Click to expand...
Click to collapse
Tbh I thought it would have been clear by now what I care about. Then again I may have been wrong about considering you one of the smart android people.
I care about learning and sharing knowledge. Which is precisely what this thread did.

cybojenix said:
See my other post, I don't care about cm.
Fair enough, 3% are here, so this benefits the security of 97% of lg uses, if the claim that lg was alright with it running s a service is true.
Either way, I did nothing wrong
Click to expand...
Click to collapse
I saw your PM to autoprime in IRC, it was "I am going to post what I found or you do, either way its going there", it wasn't lack of care, it was that you just stated a fact and left, it was a very rude unthoughtful thing to do, also don't try to BS everyone with your research, you and about 100 other people found the "magic keys", the problem is those "magic keys" were placed there by team codefire, you didn't find them, you found that they were using the key and copied their work, anything else you say is a lie, at least the other 99 people who found this had the basic respect to not post it unless the original team allowed it.
There was no reason to post this, their site was working fine, and if you used the API there was no problem of tracking since it just uses a UID to identify to the server.
at least admit you were wrong and say you are sorry, they won't fix anything but will gain you a minimum amount of respect

sooti said:
I saw your PM to autoprime in IRC, it was "I am going to post what I found or you do, either way its going there", it wasn't lack of care, it was that you just stated a fact and left, it was a very rude unthoughtful thing to do, also don't try to BS everyone with your research, you and about 100 other people found the "magic keys", the problem is those "magic keys" were placed there by team codefire, you didn't find them, you found that they were using the key and copied their work, anything else you say is a lie, at least the other 99 people who found this had the basic respect to not post it unless the original team allowed it.
There was no reason to post this, their site was working fine, and if you used the API there was no problem of tracking since it just uses a UID to identify to the server.
at least admit you were wrong and say you are sorry, they won't fix anything but will gain you a minimum amount of respect
Click to expand...
Click to collapse
Wrong, I stated that I was going to open source it, meaning the work of put in to getting the key and how it's used to get the original magic.
It was after that that I realised the final magic is the only thing needed. I actually worked out how to get the magic key a few hours ago, but since I don't have the right images, it won't be globally usable.
Fair enough, I apologise for pointing out the flaws in codefires service, and that they took it badly.

cybojenix said:
See my other post, I don't care about cm.
Fair enough, 3% are here, so this benefits the security of 97% of lg uses, if the claim that lg was alright with it running s a service is true.
Either way, I did nothing wrong
Click to expand...
Click to collapse
OK. If you did nothing wrong please do explain this
Enderblue-"well, would you be willing to open source it so we can have a official cm support?"
IoMonster-"so it would make storm already worse then what it is now? *paraphrasing for language
IoMonster-"no"
Seems like be said he didn't want it open source but you still went ahead any way.
http://hastebin.com/gulumezawi.txt
And then you saying your going to push it for vs985 even after he said no.

I don't know who Enderblue is, and I'm not affiliated with him..
whoppe862005 said:
OK. If you did nothing wrong please do explain this
Enderblue-"well, would you be willing to open source it so we can have a official cm support?"
IoMonster-"so it would make storm already worse then what it is now? *paraphrasing for language
IoMonster-"no"
Seems like be said he didn't want it open source but you still went ahead any way.
http://hastebin.com/gulumezawi.txt
And then you saying your going to push it for vs985 even after he said no.
Click to expand...
Click to collapse

cybojenix said:
I don't know who Enderblue is, and I'm not affiliated with him..
Click to expand...
Click to collapse
It isn't like it matters if you are or not. It says right in the chat he doesn't want it open sourced. I'm sure about 99% of the people on here have seen that already and I'm pretty sure you have seen it as well.
It states right in the chat he didn't want it open sourced.

whoppe862005 said:
It isn't like it matters if you are or not. It says right in the chat he doesn't want it open sourced. I'm sure about 99% of the people on here have seen that already and I'm pretty sure you have seen it as well.
It states right in the chat he didn't want it open sourced.
Click to expand...
Click to collapse
but the chat wasn't with me, so your point is null
autoprime had ample opportunity to say "don't do it yet", or "go talk to IO". but no, no objections were made.
Codefire treated the service like any other company would treat their unlocking service, so I treated them like a company and showed how it was done.

Sad news for Galaxy s9 G960U users wanting root.

I have looked around the internet and finally found over on a sprint forum some sad news about rooting. So in the case most of you are unaware, the US models for the Galaxy s9 have had their OEM Unlock(Bootloader unlock) option disabled. I finally found the reason why on an old post back from the Galaxy s8. Please don't harp on me that its a different phone because its the concept discussed that actually gives the real reason why vendors like sprint have disabled the option!
"Link to below quote: community.sprint.com/t5/Samsung-Board/OEM-Unlock-option-is-gone/td-p/965240"]https://community.sprint.com/t5/Samsung-Board/OEM-Unlock-option-is-gone/td-p/965240:
"Quoted from Community manager, seawolf's post!"
Re: OEM Unlock option is gone
First of all, wow @zahale! its my job to be somewhat aware of our current population and to keep an eye out for knowledgeable posters (we like to try to make those people Advocates, like @DJ_Damjano and @Fireguy_6364). I have run across several of your comments in this space lately and you're definitely above the curve when it comes to technical device knowledge and experience. I'm kind of following you around now just to learn Smiley Wink
I was pretty sure I knew why Sprint locks down developer options but I put the question to some of my device folks in conversation yesterday. The explanation probably won't be something you like, but hopefully, it'll be something you can understand. Unfortunately, as with many things, knowing why also won't change anything but you asked a fair question and I wanted to try to give you a fair answer.
Sprint locks things like boot loaders down to control the average customer experience and to prevent a novice user from accidentally damaging the device or negatively affecting performance. While technically such a change isn't Sprint's fault, I can tell you from experience from when I was in customer service that most customers think it is and correcting the problem, if its possible, can be a challenge at best.
Unfortunately, this is an all or nothing kind of situation. We either leave it open for everyone or we lock it down for everyone. Since we can't customize the experience based on user knowledge, we try to optimize it for the novice, which means some of the more advanced setting areas on the phone are locked down.
This is clearly important to you and I can understand why. With this particular phone there isn't anything we can do on our end to unlock the developer options for one individual. When you are ready to upgrade again, you might want to look for factory unlocked versions of the phones you like or OEMs that leave theirs unlocked (although that's harder to verify). In this case, the developer options are not locked down in the factory unlocked versions of the S8 and S8+.
SeaWolf
Sprint Community Manager & Customer Advocate
Captain of the Vicious Cream-puff
I encourage you to post your questions on the community, give Kudos when earned and always mark the correct answer as "Accepted Solution".
Like SeaWolf states, it is just easier after your contract is done to just buy a OEM unlockable version. They do this for customer based reasons to make a novice experience for all users so that new users can't brick their phone on accident messing with settings. Sorry all but OEM unlocking will never be an option for g960U users.

All US (snapdragon) model S9s have a locked bootloader, it has been the case for a long time since at least the S7....

*Detection* said:
All US (snapdragon) model S9s have a locked bootloader, it has been the case for a long time since at least the S7....
Click to expand...
Click to collapse
Yes we already know this, but this post is an update on the reason why its that way. I have looked everywhere and even asked around but no one gave me a reason why they made it this way. I finally found this post and was just sharing it for news so that people can finally understand and get an update.

WatchersGrim said:
Yes we already know this, but this post is an update on the reason why its that way. I have looked everywhere and even asked around but no one gave me a reason why they made it this way. I finally found this post and was just sharing it for news so that people can finally understand and get an update.
Click to expand...
Click to collapse
but the info is nothing new plus its just a thread of people living in the stone age mixing up sim unlock with oem unlock and then complaining about it.
US snapdagon device's bootlaoder arent unlockable its a very very well know fact. any other device destined NOT for American soil can have its BL unlocked and probably be rooted.( so thats any device made for the rest of the world). surely this info has been plastered all over xda...

https://forum.xda-developers.com/ga...s-recoveries--other-development/root-t4041815
root is out

I have been rooting and modding various and sundry devices since 2011. I find, for my purposes, the s9 doesn't need it. Of course YMMV

root guide for sm-n960u

what guide should i follow for this phone to root it? android v10

You must be new here. I believe you have to be on Android 8 to be rooted and plus, it's pointless from what I read, anyways. For one, your phone will never fully charge and 2, I'd already inquired about it, the rooting process ends up not being dependable and your phone will no longer be a daily driver. So, the thought of it is a no for me.
I doubt there's even a way to go back to Android 8 and any necessary security patch levels.
https://forum.xda-developers.com/ga...r-development/root-extreme-syndicate-t4043723

You don't have to be on oreo right now for it to work, you just need a combo firmware that uses the same bootloader revision as what you're currently on. You can currently get an oreo combo firmware up to revision 4. Basically it's a "modded" oreo firmware that uses the same bootloader version as newer firmwares.

Please change title or close this thread. Got me excited for nothing

Why close ? Its informative.
Now i know i need to sell my phone caz it cannot be rooted.
How ever, S8+ on 9.0 had root but some devices such as mine were turning into brick attempting to root them due to bootloader version conflict which was not identified by root method or person who wrote the method.
Bricked several S8+ phones attempting to root. Was too afraid to try my last one.
Hell, am not made of money buying phones every time root turns it into a brick where even EDL'ing wont fix it.

What about this ?
How to root Samsung Galaxy Note 9 SM-N960U With Odin Tool - Gogorapid
(Last Updated On: October 29, 2019)How to root Samsung Galaxy Note 9 SM-N960U With Odin Tool
www.gogorapid.com
I dont like to just follow steps on some dodgy website, i'd rather follow steps here on forum since people can validate it.
Too scared to try, too little information about side effects.

tonycstech said:
What about this ?
How to root Samsung Galaxy Note 9 SM-N960U With Odin Tool - Gogorapid
(Last Updated On: October 29, 2019)How to root Samsung Galaxy Note 9 SM-N960U With Odin Tool
www.gogorapid.com
I dont like to just follow steps on some dodgy website, i'd rather follow steps here on forum since people can validate it.
Too scared to try, too little information about side effects.
Click to expand...
Click to collapse
Yeah, don't trust random websites. They mostly contain generic procedures that are either vastly outdated or downright wrong.
I have a rooted N960U, and this is what it takes to get there:
To actually be able to root an N960U, you have to be on a software version with an Android security patch level of February 1, 2021 or older (if you look at the baseband version under software information in the About phone section under Settings, the 5th digit from the right should be a 7 or lower number). Anything newer than that is unrootable as far as I know. And for the rooting procedure, you have to unlock the bootloader first which currently requires a paid service as mentioned in the following post:
https://forum.xda-developers.com/t/...iers_fix_safetynet_aio.4217753/#post-85381639

Finlay someone giving useful info.
I looked at the sampwn website for unlocking service and i didnt like it.
It threw some kind of subscribe message at me covering entire page so i couldn't even see what the website is all about.
Then it constantly showing "someone purchased this or that" and opens a chat i dont want to see.
Those are 3 red flags for a fishy website so i have to pass.
I did how ever manage to look at the purchase process page and it was also full of red flags.
It was asking too much personal information.
It did not say what you are buying, how much you going to pay for it or what payment method is accepted.
Entire website has a theme of a scammer website, or at the very least it was built using those themes and thus it acts just like it.
Telegram, discord username required ? What if i dont have one ?
Do you want my password to my bank as well ?
Card number with expiration date and full name address and 3 security digits to pay ?
Are you F'ing serious ?
I dont know a single website that sell you stolen serial keys or cracked software that ask you this much information and claim "its required"
Besides, if there is a paid way, there must be a free way.
Who is this guy, owner of some sort of unlocking device ?
Whats the point of locking it if some lone wolf can unlock it anyway ?
Very sketchy.

tonycstech said:
Finlay someone giving useful info.
I looked at the sampwn website for unlocking service and i didnt like it.
It threw some kind of subscribe message at me covering entire page so i couldn't even see what the website is all about.
Then it constantly showing "someone purchased this or that" and opens a chat i dont want to see.
Those are 3 red flags for a fishy website so i have to pass.
I did how ever manage to look at the purchase process page and it was also full of red flags.
It was asking too much personal information.
It did not say what you are buying, how much you going to pay for it or what payment method is accepted.
Entire website has a theme of a scammer website, or at the very least it was built using those themes and thus it acts just like it.
Telegram, discord username required ? What if i dont have one ?
Do you want my password to my bank as well ?
Card number with expiration date and full name address and 3 security digits to pay ?
Are you F'ing serious ?
I dont know a single website that sell you stolen serial keys or cracked software that ask you this much information and claim "its required"
Besides, if there is a paid way, there must be a free way.
Who is this guy, owner of some sort of unlocking device ?
Whats the point of locking it if some lone wolf can unlock it anyway ?
Very sketchy.
Click to expand...
Click to collapse
Whatever method is being used to unlock the bootloader on these models has not been made public, so that's why there are only paid ways.
I can't speak for SamPWND as I used the first link with UNSAMLOCK, and the guy running it was quite helpful and did things quickly. But you do need to contact him through Telegram.
This is certainly not for everyone, so you really have to be sure you want it as it's a one-time, one device only thing. Otherwise, you'll have to look at the Exynos models or the international Snapdragon N9600 model for freely available bootloader unlocking and rooting methods.

SamPWND is a group on telegram i joined.
But i cant contact anyone there. All i get is what the owner posts.
How am i suppose to contact the owner if i want to unlock my bootloader ?
Jeezes ! Why they make things more complicated then they need to ?
In any case, the owner of that channel is some guy named Mohammad Afaneh
Are you F'ing kidding me ?
I am not sending my phone to some guy named Mohammad. Hell no !
He either hack it or put ship me a bomb back that will explode when i open it.

tonycstech said:
SamPWND is a group on telegram i joined.
But i cant contact anyone there. All i get is what the owner posts.
How am i suppose to contact the owner if i want to unlock my bootloader ?
Jeezes ! Why they make things more complicated then they need to ?
Click to expand...
Click to collapse
That's pretty strange for a Telegram group. Check the UNSAMLOCK one then as that's the one I used and had no problems with.
But remember that only older software versions are eligible. If yours is later than February 2021, then you won't be able to do anything.

tonycstech said:
SamPWND is a group on telegram i joined.
But i cant contact anyone there. All i get is what the owner posts.
How am i suppose to contact the owner if i want to unlock my bootloader ?
Jeezes ! Why they make things more complicated then they need to ?
In any case, the owner of that channel is some guy named Mohammad Afaneh
Are you F'ing kidding me ?
I am not sending my phone to some guy named Mohammad. Hell no !
He either hack it or put ship me a bomb back that will explode when i open it.
Click to expand...
Click to collapse
Afaneh has a good rep on XDA, for all I've seen. But I read you about Telegram, kinda irritrates me how it's taken away from the much more available xda forums. I could join, but like I was saying elsewhere just last night, I'm already way too "joined" as it is.