I was wondering this morning what UMS in ODIN flashes... I googled around and found a site (somewhat unreliable) that seemed to think that UMS was a way for developer edition devices to flash unsigned zip files (alike CWM or TWRP).
When a non-developer edition phone gets plugged in to ODIN, UMS is instantly greyed out. Can anyone with a Dev device test this and see?
If this is true, that seems like a great place to look for vulnerabilities that could lead to the ability to flash unsigned zips on non-dev devices, thence are one step closer to AOSP/GPE ROMs...
I know that the bootloader will reject the AOSP kernel, but I know that (attempting to) flash recovery trips the KNOX (0x1) warranty. So if there was no need for custom recovery, we would only have to find a way to either trick the device into thinking it is a dev edition, or finding a way to disable kernel checks. (Still a large undertaking, but maybe a little easier?)