[2013.03.21][ROOT] TriangleAway v2.90

---

Many Samsung devices store a flash counter that keeps track of how many times you have flashed custom firmwares to your device. On some devices, a yellow triangle or other sort of visual warning is also displayed during boot if you are running a custom firmware. TriangleAway was built to disable the triangle (if a visual warning is present) and reset the custom ROM flash counter to 0. This app requires root !

You can find out the current status of your flash counter and firmware state (custom or official) by booting into "download mode" on most devices. The usual way of getting into "download mode" is by first turning off your device, then turning it on by pressing and holding VolDown+(Home)+Power. Alternatively, the "adb reboot download" command also often works.

When you run TriangleAway, if your device and firmware are supported, it will show you the detected state of the binary (custom or official) and flash counter value, and the option to Reset flash counter. Please confirm that the information shown is correct before resetting the values.

On a number of devices, TriangleAway can work, but your firmware may not be supported directly. In that case, the app will tell you it needs to reboot into a special boot mode, which will be happen if you select Reset flash counter. The device will reboot into a special mode which will allow you to review the current status and reset the binary and flash counter values (or abort and do nothing). On some devices this will actually trigger the counter to 1 if its 0 - so if you're "just checking", do that in download mode!

THIS IS A DANGEROUS OPERATION AND COULD POTENTIALLY BRICK YOUR DEVICE. PROCEED AT YOUR OWN RISK. A USB JIG IS PREFERRED IF YOU HAVE A WORKING ONE.
( and by brick I mean brick - only a board replacement or a JTAG unit will be able to save you, don't mess with boot(loader) stuff unless you really mean it! )

Note#1: using Triangle Away may unmount your SD card. Reboot or manually remount it from Android settings.

Note#2: on new devices like the SGS3/SGNote2/SGNote10.1, the "system modified" status can only be reset on some firmwares - they must be stock firmwares!

FAQ

- Triangle Away shows a negative counter ?
If you have a very large flash count (over 127) this is known to happen. Please confirm in download mode that you actually have that large a flash count before resetting the counter.

- After using Triangle Away I get no bootscreen at all or an error message on screen ?
Try flashing the attached "param.tar" as PDA in ODIN (no repartition!), that may clear up the issue. Samsung Galaxy S II GT-I9100 ONLY

- What about future updates and devices ?
Please read this article I wrote about this: http://www.chainfire.eu/articles/118...ay_vs_Samsung/

- On my SGS3/Note2/etc, Download Mode says my System is modified, and Triangle Away does not reset it
Triangle Away attempt to reset this status and block it from coming back, but it depends on the firmware. It does work on some (not all) stock firmwares. Resetting this value doesn't work on custom firmwares! See the post below this one for more information.

- On the SGS3/Note2/etc, System->Settings->About device->Status still shows "Modified"
This is outside the scope of Triangle Away. The "system" status is not even always resettable in the bootloader. If you are going for warranty, you need to also reflash a full stock firmware and wipe your device. If they boot up your device and find root apps, you're not going to get any warranty anyway. If you do such a full stock reflash and wipe, the "Modified" value will go away. See the post below this one for more information.

- My counter always stays at 1
Some devices/bootloaders set the counter to 1 at every boot if you are running a custom kernel or recovery. On these devices, Triangle Away may always display 1 - make sure to check the counter in actual download mode, and make sure you are running a stock Samsung kernel and recovery.

Supported devices

Samsung Galaxy S2 GT-I9100 **
Samsung Galaxy S2 SPH-D710 Epic 4G Touch **
Samsung Galaxy S2 Korea SHW-M250K/L/S **
Samsung Galaxy Note GT-N7000 **
Samsung Galaxy Note GT-I9220 **
Samsung Galaxy S3 GT-I9300 **
Samsung Galaxy S3 GT-I9300T **
Samsung Galaxy S3 AT&T
Samsung Galaxy S3 Sprint
Samsung Galaxy S3 T-Mobile
Samsung Galaxy S3 Verizon UNLOCK BOOTLOADER
Samsung Galaxy S3 Canada
Samsung Galaxy S3 US Cellular
Samsung Galaxy S3 MetroPCS
Samsung Galaxy S3 Cricket
Samsung Galaxy S3 C-Spire
Samsung Galaxy S3 GT-I9305 LTE **
Samsung Galaxy S3 GT-I9305T LTE **
Samsung Galaxy S3 GT-I9305N LTE **
Samsung Galaxy S3 Korea SHV-E210K/L/S ** DISABLE DUE TO ISSUES
Samsung Galaxy S3 Korea SHW-M440S **
Samsung Galaxy Note 2 GT-N7100/T **
Samsung Galaxy Note 2 GT-N7102 **
Samsung Galaxy Note 2 GT-N7105/T LTE **
Samsung Galaxy Note 2 SPH-L900 Sprint **
Samsung Galaxy Note 2 SGH-T889 T-Mobile **
Samsung Galaxy Note 2 SGH-T889V Canada **
Samsung Galaxy Note 2 SGH-R950 US Cellular **
Samsung Galaxy Note 2 AT&T/Canada SGH-I317/M **
Samsung Galaxy Note 2 SCH-I605 Verizon ** UNLOCK BOOTLOADER
Samsung Galaxy Note 2 Korea SHV-E250K/L/S **
Samsung Galaxy Camera EK-GC100 **
Samsung Galaxy Note 10.1" GT-N8000 3G **
Samsung Galaxy Note 10.1" GT-N801x Wi-Fi **
Samsung Galaxy Note 10.1" GT-N8020 LTE **
Samsung Galaxy Note 10.1" SHW-M480S/K/W **
Samsung Galaxy Tab 2 GT-P310x 7" 3G
Samsung Galaxy Tab 2 GT-P311x 7" Wi-Fi
Samsung Galaxy Tab 2 GT-P510x 10.1" 3G
Samsung Galaxy Tab 2 GT-P511x 10.1" Wi-Fi
Samsung Galaxy Ace 2 GT-I8160
Samsung Galaxy S Advance GT-I9070/P
Samsung Galaxy S3 Mini GT-I8190
Samsung Galaxy Grand Duos GT-I9082
Samsung Galaxy Ace Plus GT-S7500
Samsung Galaxy Ace IIx GT-S7560
Samsung Galaxy S Duos GT-S7562
Samsung Galaxy Premier GT-I9260

Various Qualcomm-based Samsung devices should now be supported as well, but I don't know which ones - please let me know!
Suspected is a large range of Qualcomm based Note and S2 variants.

** Various related models are supported depending on firmware, but only the exact model numbers listed are supported regardless of firmware version.

Whether or not Triangle Away works depends largely on your kernel. Flashing a different kernel may make it work if it previously didn't.

Download

Download from Google Play

The Google Play download is not free - it costs about a beer (thanks!). The download listed below is 100% the exact same program, but free. I provide it for free because I believe this app should be available even to people who cannot pay on Google Play. If you are able to purchase on Play, please consider that I have spent a great many hours on this, and the latest version also uses server resources I have to pay for.

REDISTRIBUTION IS NOT ALLOWED

( 1.00: 634; 1.10: 12795; 1.25: 59699; 1.50: 2891; 1.51: 45740; 1.70: 30839; 1.80: 13997; 1.90: 26020; 2.00: 10141; 2.05: 2421; 2.06: 755; 2.10: 17703; 2.15: 4780; 2.20: 4219; 2.25: 2861; 2.26: 11340; 2.30: 5132; 2.35: 676; 2.36: 16139; 2.37: 77595; 2.40: 12019; 2.45: 2725; 2.50: 7233; 2.55: 19784; 2.60: 54862; 2.65: 2957; 2.70: 6734; 2.75: 41790; 2.80: 2314; 2.85: 5092 )

System Modified Status

---

The latest Samsung devices store "system modified ?" flags next to the "flash counter" and "current binary official ?" that Triangle Away traditionally resets.

It actually has this "system modified ?" flag twice. Once in the bootloader, once in Android itself. When resetting the flash counter, Triangle Away does attempt to reset the one stored in the bootloader (that you can see from Download mode), and disable it from being updated. However, whether or not this works is completely dependent on your device model and firmware version.

The flag in Android itself can be seen under Settings --> About Device --> Status --> Device Status. This one also affects whether or not the firmware will allow you to download and flash OTA updates, and may affect DRM apps and the allshare cast dongle.

Version 2.50 of Triangle Away introduced a "allow tracker to run" option that can re-enable syscope if it was disabled by resetting the flash counter. After doing this and rebooting, in some cases this reverts to status under Settings to normal. However, in my personal experience this only works temporarily, and after a number of hours the status will revert to modified in both Settings as well as the bootloader, after which you will have to use Triangle Away to reset the status. This behavior is dependent on firmware, for some users this option works reliably. Alternatively, you can use the next option, which is more reliable, but less convenient.

Version 2.45 of Triangle Away introduced a "system modified workaround" option that tries to counter the flag in Android under Settings. This option is dependent on a fair number of factors:
- You must be running a stock Samsung ROM
- The SysScope package must be intact (if you removed it, it will likely not work)
- You must be using SuperSU as your root rights management app (Superuser is not supported)
- You must be using either the Play version of Triangle Away or have SuperSU Pro installed

A side-effect of this workaround is that root will be disabled for about five minutes after boot (yeah...). During that time, Triangle Away will display a notification. All your apps that launch at boot and do something that requires root will not be able to gain root access during this time. A well-coded root app should not care about this much, but unfortunately not all apps are coded that defensively, and app crashes may occur. When root access is restored, Triangle Away will re-launch the apps that are set to launch at boot and have been granted access in SuperSU, so these root apps may still initialize themselves properly.

Personally, I find this too annoying to use constantly, but due to being a developer, I reboot a lot. One way to use it would be to use the standard reset flash counter method that resets the bootloader value (and if you're lucky will keep the system status in the bootloader as "official" as well), and once in a while use the workaround patch when you want to check for OTAs and such only.

There are also some caveats:
- This workaround is incompatible with the reset function used when you reset the flash counter. As such, the "system modified" status flag in the bootloader may start updating again (resetting the counter itself will still work, though) if you enable the workaround. It will reflect the status you can see in Android. If you disable the workaround again, you are advised to reset the flash counter again afterwards.
- If your system is modified by other root tools, the "modified" status may still be triggered, regardless of this workaround
- I wanted to implement all this in a much cleaner way, but due to a bug in Samsung's modifications of the package manager, that method would often result in corrupted data and the inability to modify/(un)install any apps after the corruption occurs. Note that this corruption may still occur "naturally", and Triangle Away will inform of you of this problem if it occurs during enabling of the workaround. Unfortunately, there is no known solution to this issue other than wiping all your data (factory reset).
- I fully expect Samsung to prevent this patch from working in the near future, so use it while it's hot.

Note to developers:
In case your app uses a BOOT_COMPLETED receiver and has been granted access in SuperSU, it will receive a second BOOT_COMPLETED intent from Triangle Away once root access has been restored. The second intent will have an extra present named "eu.chainfire.triangleaway.BOOT_COMPLETED"

Technical details (Updated 13.02.2012) (outdated)

---

The flash counter and triangle state had to be stored somewhere. Everybody knew that. Guesses have been made in the past where it could be, and I have personally compared the raw flash disk contents between different amount of custom flashes in the past, unable to find any differences. You can dump and compare the entire /dev/block/mmcblk0 and you won't find a difference (you'll find a few unallocated and unused gaps, though).

The solution comes with the new kernel uses by ICS builds. The flash disk actually has two hidden boot partitions, /dev/block/mmcblk0boot0 and /dev/block/mmcblk0boot1 . The MMC driver in the kernels used for Gingerbread did not present these partitions in the past, the MMC driver in the ICS kernel does.

Teamhacksung members said something about having found the location, so I retried locating the position on ICS. Until recently I had always ran the KH4 Gingerbread build because until the LPB ICS build USB host was not properly supported on ICS, and I need that for other apps I make. It's really easy to find now on ICS. Dump and compare the partitions and you'll have found them in no time. I've already done it, so here is the information.

Structure /dev/block/mmcblk0boot0 @ 0x00020000:

0x00020000 header magic: 32bit - 0x12340011
0x00020004 flash count: 16bit
0x00020006 future: 16bit - 0x0000
0x00020008 type: 16bit - 0x0000 unknown, 0x0001 custom (triangle), 0x0002 Samsung Official
0x0002000A name: max 16 chars
0x0002001A end: 16bit - 0x0000

The boot partitions are presented as readonly by default, but allowing modification is a simple matter of executing the following before writing the data:

echo 0 > /sys/block/mmcblk0boot0/force_ro

That should give you all the information you need to replicate this. A number of bytes trailing this structure also change between flashes and appear to be checksum related.

As stated above, this isn't easily doable on Gingerbread. That is also why this currently does not work on the SGNote. When ICS is released for the SGNote it'll probably be compatible out of the box, or trivial to make it compatible. I say on Gingerbread it is not easily doable, but it is not impossible. If you put a lot of effort into it, you can probably talk to the MMC device directly and modify these partitions, I personally don't feel it is worth the effort for Gingerbread, as (at the time of this writing) official ICS firmwares should be available for both the SGS2 as well as the SGNote very shortly.

Update 16.02.2012: Users have confirmed TriangleAway works on the I9220 SGNote ICS leak !
Update 13.05.2012: TriangleAway does *not* work on the latest official SGNote ICS firmwares. There will be a fixed version soon, but it has to wait for my Note to return from repairs, else I cannot test it
Update 04.06.2012: v1.50 should work with the I9220 and N7000 SGNote's again

--- reserved ---

Changelogs

---

21.03.2013 - v2.90
- Support for:
--- Samsung Galaxy Ace Plus GT-S7500
--- Samsung Galaxy Ace IIx GT-S7560
--- Samsung Galaxy S Duos GT-S7562
--- Samsung Galaxy S2 Korea SHW-M250K/L/S
--- Samsung Galaxy Premier GT-I9260

18.03.2013 - v2.85
- improved dump file
- Support for:
--- Samsung Galaxy Grand Duos GT-I9082

17.03.2013 - v2.80
- Added feature to create a helpful dump file

23.02.2013 - v2.75
- Updated SGS3 I9300 kernel with SDS patch

20.02.2013 - v2.70
- Support for:
--- Samsung Galaxy S3 Mini GT-I8190
--- Samsung Galaxy S3 MetroPCS
--- Samsung Galaxy S3 Cricket
--- Samsung Galaxy S3 C-Spire

19.02.2013 - v2.65
- Support for:
--- Samsung Galaxy Ace 2 GT-I8160
--- Samsung Galaxy S Advance GT-I9070/P

20.01.2013 - v2.60
- Support for:
--- Samsung Galaxy Note 2 SGH-T889V Canada

10.01.2013 - v2.55
- Support for:
--- Samsung Galaxy S2 SPH-D710 Epic 4G Touch

07.01.2013 - v2.50
- Added option to re-enable tracker after counter reset disabled it, works for some to restore system "normal" status temporarily(!)
- Fixed issue with the modified system status workaround, that root would never come back. If you're suffering from this problem, try keeping your phone fully on for 10 minutes or more, then root will return. Run Triangle Away again afterwards.

06.01.2013 - v2.45
- Implemented modified system status *workaround* (requires SuperSU)
- Support for:
--- Samsung Galaxy Camera EK-GC100
--- Samsung Galaxy Note 2 LTE GT-N7100T and GT-N7105T

01.01.2013 - v2.40
- Support for:
--- Samsung Galaxy Note 2 Verizon SCH-I605 (unlocked bootloader only !)

17.11.2012 - v2.37
- Disable E210* support due to touchscreen issues. Bad kernel source ?

08.11.2012 - v2.36
- Adjustment for AT&T Note 2

08.11.2012 - v2.35
- Support for:
--- Samsung Galaxy S3 Korea SHV-E210K/L/S
--- Samsung Galaxy S3 Korea SHW-M440S
--- Samsung Galaxy Note 2 Korea SHV-E250K/L/S
--- Samsung Galaxy Note 2 AT&T/Canada SGH-I317/M

05.11.2012 - v2.30
- Updated: Roboto font is now used in special boot mode
- Updated: Added (another) counter=1 warning in special boot mode
- Support for:
--- Samsung Galaxy Note 2 SGH-R950 US Cellular

31.10.2012 - v2.26
- Support for:
--- Samsung Galaxy S3 GT-I9305N LTE

30.10.2012 - v2.25
- Fixed: N8020 problem
- Improved: system status reset
- Support for:
--- Samsung Galaxy Note 10.1" SHW-M480S/K/W

28.10.2012 - v2.20
- Support for:
--- Samsung Galaxy Note 2 SGH-T889 T-Mobile

26.10.2012 - v2.15
- Support for:
--- Samsung Galaxy Note 2 SPH-L900 Sprint

16.10.2012 - v2.10
- Support for:
--- Samsung Galaxy Note 10.1 LTE GT-N8020

16.10.2012 - v2.06
- Support for:
--- Samsung Galaxy S3 LTE GT-I9305T

15.10.2012 - v2.05
- Support for:
--- Samsung Galaxy S3 LTE GT-I9305
--- Samsung Galaxy Note 2 LTE GT-N7100
--- Various Qualcomm-based Samsung devices

09.10.2012 - v2.00
- Support for:
--- Samsung Galaxy Note 2 GT-N7100

15.09.2012 - v1.95
- Support for:
--- Samsung Galaxy S3 SHV-E210K
--- Samsung Galaxy S3 SHV-E210S

24.08.2012 - v1.90
- Support for:
--- Samsung Galaxy Note GT-N8000 10.1" 3G **
--- Samsung Galaxy Note GT-N801x 10.1" Wi-Fi **

15.08.2012 - v1.80
- Support for:
--- Samsung Galaxy S3 US Cellular
--- Samsung Galaxy Tab 2 GT-P310x 7" 3G
--- Samsung Galaxy Tab 2 GT-P311x 7" Wi-Fi
--- Samsung Galaxy Tab 2 GT-P510x 10" 3G
--- Samsung Galaxy Tab 2 GT-P511x 10" Wi-Fi

18.07.2012 - v1.70
- Support for:
--- Samsung Galaxy S3 AT&T
--- Samsung Galaxy S3 Sprint
--- Samsung Galaxy S3 T-Mobile
--- Samsung Galaxy S3 Verizon
--- Samsung Galaxy S3 Canadia

06.06.2012 - v1.51
- Support for Galaxy S3 GT-I9300T

04.06.2012 - v1.50
- Fixes for Galaxy Note GT-N7000/GT-I9220
- Support for Galaxy S3 GT-I9300

02.03.2012 - v1.25
- Updated icon
- Updated some texts
- Added automatic reset at boot option
- Uploaded to Market

13.02.2012 - v1.10
- Updated technical details
- Device check removed, instead the app checks the header magic
- Internal structure changed

Interesting, waiting longer description.
Thanks,

Thanks Chainfire!

Is that BRICK as in permanent, or recoverable ?

Wow, if this works like you're saying, this is huge chainfire. Nice work!!

great progress mate
thanks you

cheers,

SX