[BOUNTY]New Root+Recovery method and/or Bootloader Unlock

Search This thread

CAG-man

Senior Member
Apr 19, 2013
479
315
Athens, Ohio
www.cag-creations.com

housry23

Senior Member
Sep 23, 2009
2,939
746
Springfield, OH
I had the stupid update nagging me all day yesterday and I kept hitting remind me later. I was not at my desktop. When I got home, I figured I'll just wait until the morning to root. Went to bed. Woke up to "the update was successfully installed" message on my s4 and now I'm screwed. Oh I hate AT&T! I'm not even an AT&T customer! Stupid locked bootloaders are stupid.

So...there's no way to roll back with heimdall? I want to try, but I'm afraid I'll do irreversible damage. Has anyone tried with Heimdall?
 
J

jetlitheone

Guest
I had the stupid update nagging me all day yesterday and I kept hitting remind me later. I was not at my desktop. When I got home, I figured I'll just wait until the morning to root. Went to bed. Woke up to "the update was successfully installed" message on my s4 and now I'm screwed. Oh I hate AT&T! I'm not even an AT&T customer! Stupid locked bootloaders are stupid.

So...there's no way to roll back with heimdall? I want to try, but I'm afraid I'll do irreversible damage. Has anyone tried with Heimdall?

There is no possible way, sorry :(

Sent from my SGH-I337 using Tapatalk 2
 

housry23

Senior Member
Sep 23, 2009
2,939
746
Springfield, OH
Thanks man. That is terrible! I can't believe it updated on its own. I was super mad when I woke up and saw that. So...I would certainly donate to a root method if achieved. I don't want to commit though because I'm currently trying to sell the phone. If root is obtained before I sell, or, I decide to keep, I'll certainly donate. I always do!
 

jeffreii

Senior Member
Nov 3, 2005
767
163
Miami, FL
I had the stupid update nagging me all day yesterday and I kept hitting remind me later. I was not at my desktop. When I got home, I figured I'll just wait until the morning to root. Went to bed. Woke up to "the update was successfully installed" message on my s4 and now I'm screwed. Oh I hate AT&T! I'm not even an AT&T customer! Stupid locked bootloaders are stupid.

So...there's no way to roll back with heimdall? I want to try, but I'm afraid I'll do irreversible damage. Has anyone tried with Heimdall?

For future reference, or for someone else, you could have avoided this easily!

1) Don't hit "remind me later"! You can only do that so many times before it forces the update. INSTEAD, you can just hit the home button and force your way out, not making any decision. You can do this indefinitely...but it's annoying so you should just 2) Get Titanium Backup and freeze the OTA update apps so they don't bother you! It's right at the top of the beginner's info aka noob helper thread:
http://xdaforums.com/showthread.php?t=2301762

You probably already knew this but maybe it will help someone else who's not prepared to avoid this OTA!
 

housry23

Senior Member
Sep 23, 2009
2,939
746
Springfield, OH
For future reference, or for someone else, you could have avoided this easily!

1) Don't hit "remind me later"! You can only do that so many times before it forces the update. INSTEAD, you can just hit the home button and force your way out, not making any decision. You can do this indefinitely...but it's annoying so you should just 2) Get Titanium Backup and freeze the OTA update apps so they don't bother you! It's right at the top of the beginner's info aka noob helper thread:
http://xdaforums.com/showthread.php?t=2301762

You probably already knew this but maybe it will help someone else who's not prepared to avoid this OTA!

i didn't know about the home button thing. The only reason I went back to stock is because I thought I had someone trading me phones. I haven't had this phone very long and hadn't read much about it except that the update breaks root, so I knew not to take it. The stupid guy from CL flaked and now I'm stuck with an unrooted phone. I'm not happy lol! I was planning on rooting this morning, but woke up to the lovely "the update was successful" message. Thanks for the info man. It's been a long time since I've had a sammy phone, so I really had no idea what most of the stuff meant until I got to reading this morning.

I hope your post will help at least 1 person avoid the mistake I made!!!
 

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
I read the OP, but I did not read through this whole thread. Because of my recent experiences with the MF3 update, I can say that the OP requires some updating for clarification. I encourage you to read the following information I have gathered on the subject:
  • The MF3 update patched the Loki exploit that was in the MDB/MDL "aboot" part of the bootloader that Dan discovered/published.
  • The MF3 update patched the exploit that Dan's "motochopper" rooting method took advantage of.
  • The MF3 update indeed blew Qfuses (permanently increased the monotonic counter on an e-fuse) such that the device will refuse to accept, and refuse to boot any firmware that is older than MF3.
  • The bootloaders are digitally signed such that replacing them with custom code will cause them to fail to load - causing hard bricks if attempted.
  • Without a custom bootloader, we have no hope of ever running other native-linux operating systems, Windows, or IOS. Emulation and "chroot" methods might still exist, but these are not the same.
  • Normally, recovery images and Kernels are signed, and must be verified by "aboot" (the last stage of the bootloader) upon boot. This makes booting a custom recovery or custom ROM "impossible."
  • Previous to MF3, Dan's Loki exploit worked around a security flaw in aboot. His patch would be applied to a custom recovery or a custom Kernel to allow it to be accepted by aboot.
  • Obtaining root will NOT grant us a custom recovery. This would require a completely separate exploit that would be similar to an unlocked bootloader, or an otherwise an exploit around the locked bootloaders (like Loki).
  • If you're looking for fully unlocked bootloaders, you're looking for the ability to fundamentally change the operating system on this android device. Granted, this would also allow custom recovery, or custom roms.

I hope you find this information useful. Even more, I hope that a root for MF3 is found, for the benefit of everyone now stuck on MF3. It would be great to find a new exploit that allows custom recoveries and custom kernels again. But most important for me, would be unlocked bootloaders such that we can replace them with the bootloaders necessary to run things like native Ubuntu linux.
 
Last edited:
J

jetlitheone

Guest
I read the OP, but I did not read through this whole thread. Because of my recent experiences with the MF3 update, I can say that the OP requires some updating for clarification. I encourage you to read the following information I have gathered on the subject:
  • The MF3 update patched the Loki exploit that was in the MDB/MDL "aboot" part of the bootloader that Dan discovered/published.
  • The MF3 update patched the exploit that Dan's "motochopper" rootign method took advantage of.
  • The MF3 update indeed blew Qfuses (permanently increased the monotonic counter on an e-fuse) such that the device will refuse to accept, and refuse to boot any firmware that is older than MF3.
  • The bootloaders are digitally signed such that replacing them with custom code will cause them to fail to load - causing hard bricks if attempted.
  • Without a custom bootloader, we have no hope of ever running other native-linux operating systems, Windows, or IOS. Emulation and "chroot" methods might still exist, but these are not the same.
  • Normally, recovery images and Kernels are signed, and must be verified by "aboot" (the last stage of the bootloader) upon boot. This makes booting a custom recovery or custom ROM "impossible."
  • Previous to MF3, Dan's Loki exploit worked around a security flaw in aboot. His patch would be applied to a custom recovery or a custom Kernel to allow it to be accepted by aboot.
  • Obtaining root will NOT grant us a custom recovery. This would require a completely separate exploit that would be similar to an unlocked bootloader, or an otherwise an exploit around the locked bootloaders (like Loki).
  • If you're looking for fully unlocked bootloaders, you're looking for the ability to fundamentally change the operating system on this android device. Granted, this would also allow custom recovery, or custom roms.

I hope you find this information useful. Even more, I hope that a root for MF3 is found, for the benefit of everyone now stuck on MF3. It would be great to find a new exploit that allows custom recoveries and custom kernels again. But most important for me, would be unlocked bootloaders such that we can replace them with the bootloaders necessary to run things like native Ubuntu linux.

Thanks a lot, good info I'll try to update it. Seems root is accessible look at the Verizon bounty thread to see what I mean. The same exploit they found to partially work should work on our devices as well on MF3

Sent from my GT-I9505G using Tapatalk 4 Beta
 
J

jetlitheone

Guest
Anyways will be updating your "pledges" later guys I'm on mobile and its a pain to do all the math and stuff lol. Work in the morning :banghead:

Sent from my GT-I9505G using Tapatalk 4 Beta
 

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
Thanks a lot, good info I'll try to update it. Seems root is accessible look at the Verizon bounty thread to see what I mean. The same exploit they found to partially work should work on our devices as well on MF3

Sent from my GT-I9505G using Tapatalk 4 Beta

I will test it out, fully, and post my results.

---------- Post added at 11:41 PM ---------- Previous post was at 11:20 PM ----------

It appears it won't work. For some reason, the Verizon handset will allow executing programs directly from the external SD Card, which is critical for this exploit. On the I337 with MF3, it appears that this is not possible (just as it is not possible to do so with the internal SD Card). I also attempted to take advantage of the motochopper method of copying it over to /data/local/tmp/ and executing it there, but I cannot copy to that location. If someone finds a location that we can copy files to and also execute them, please let everyone know!
 
J

jetlitheone

Guest
I will test it out, fully, and post my results.

---------- Post added at 11:41 PM ---------- Previous post was at 11:20 PM ----------

It appears it won't work. For some reason, the Verizon handset will allow executing programs directly from the external SD Card, which is critical for this exploit. On the I337 with MF3, it appears that this is not possible (just as it is not possible to do so with the internal SD Card). I also attempted to take advantage of the motochopper method of copying it over to /data/local/tmp/ and executing it there, but I cannot copy to that location. If someone finds a location that we can copy files to and also execute them, please let everyone know!

Ahh, well that sucks but so does my Linux/JavaScript language so I surely won't be the one to figure it out :| (just learning now)

Sent from my GT-I9505G using Tapatalk 4 Beta
 

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
I'm gonna call out some names here on this one.
@djrbliss - do you know of any other places on the I337 handset that would allow us to copy an executable to, and also allow us to execute said executable from? I know that this is an essential part of your motochopper exploit, so you might know of other places besides /data/local/tmp ...


(thank you for your precious time, Sir!!)
 

Radukk

Senior Member
Jul 25, 2010
315
68
On the I337 with MF3, it appears that this is not possible (just as it is not possible to do so with the internal SD Card).

I wonder whether you did format microsd as exfat. I see several posts on that thread because of this. I am pretty sure you did check but just in case. Thanks

Sent from my SGH-I337 using xda premium
 

bhp090808

Senior Member
Jan 23, 2012
539
766
Sebring
For any of you brave souls that wanna give this a shot for root on mf3 I added our phone into the exploit. the instructions come from Open1your1eyes0, the modded exploit comes from PWM978, and the original exploit comes from DooMLord. all credit goes to these individuals if this works.

First you must format your external SD card to exFAT. I've been seeing if its 64g you can do this directly from your phone. if its smaller use a pc. put the external SD card back in you phone.

-download and install the rootATTs4.zip to your pc.
-unzip the file and place all contents on your SD card
-download and open a terminal emulator app on your phone

-run these three commands (some have reported having to run the ./pwn step a few times before it works in emulator)
1 - cd /mnt/extSdCard (hit enter)

2- ./pwn (hit enter)

3- ./script.sh (hit enter)

after its done go open superuser and test to see if it worked. Hope your rooted! :laugh::good:
if i get reports this works i'll start a thread for it. If it doesnt back to the drawing board.



https://mega.co.nz/#!ttF1nTZD!TF1X_S-da1zABo9SQ-0KSEOe86NR9fnkgCC-MFDbMs4
 
Last edited:

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
For any of you brave souls that wanna give this a shot for root on mf3 I added our phone into the exploit.
Testing it again this morning while less intoxicated. Currently using my "Unadulterated" MF3 rom, which doesn't have root from the get-go. I've noticed that sometimes you have to run motochopper a few times, so it wouldn't surprise me if you have to run the pwn app a few times.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 30
    Hi guys, I know there is some interest in Safestrap here, and while I'm not posting too much to these forums (yet) I do plan on building a Safestrap for all of the locked S4s.

    Some Notes:

    Please be cautious when testing. The software is getting closer, its not quite there yet. And there is a potential for needing to ODIN restore to fix.

    Also, a word about the bounty:
    I don't dev for bounties. I also will not stand for someone else posting in this thread "hey look! I found that Safestrap works on our device! I claim a bounty!"

    If you want to donate to say thanks, after using Safestrap, I'm 100% ok with that.

    DONT EVER DONATE TO DEVS BASED ON EXPECTATION. There are just too many unknowns in the world of smartphones.

    Perhaps keep these bounties open for a full bootloader unlock.

    Sent from my DROID RAZR HD using Tapatalk 2
    9
    Thread lightly cleaned...

    To clarify ..

    i337m bootloader is not locked folks...

    no reason to be disrespectful to users who do not understand that.
    8
    i337m bootloader does have a lock.
    337 and 337m are the same phone with a different country code. First time I rooted my s4 I accidentally turned it into an ATT phone.
    took me all day but I fount csc changer on google play and it worked when my phone was rooted and I changed it back to a koodo phone. btw I also went thru having it branded a rogers phone and some other country where the y and z are switched on the keyboard. so everyone use your loopholes to not pay anyone but senior members or use them to hang yourselves I don't care.

    You need to be banned. The information you are spreading is inaccurate and potentially damaging. You were already told that the I337M has different firmware and boot-loader than the I337 (AT&T). Insulting other members will not change this fact.
    7
    Looks like something major is happening in the Verizon thread
    http://xdaforums.com/showthread.php?t=2384222

    http://xdaforums.com/showthread.php?t=2421825

    Hopefully once they get the safe strap working we can implement it into our att version and be able to do the same thing n maybe we can have a boot loader unlock exploit from this. Fingers crossed. Really great job from hash and obseidon for taking time out of their lives to figure this out and they don't even have s4's
    Sent from my SAMSUNG-SGH-I337 using xda app-developers app
    6
    I read the OP, but I did not read through this whole thread. Because of my recent experiences with the MF3 update, I can say that the OP requires some updating for clarification. I encourage you to read the following information I have gathered on the subject:
    • The MF3 update patched the Loki exploit that was in the MDB/MDL "aboot" part of the bootloader that Dan discovered/published.
    • The MF3 update patched the exploit that Dan's "motochopper" rooting method took advantage of.
    • The MF3 update indeed blew Qfuses (permanently increased the monotonic counter on an e-fuse) such that the device will refuse to accept, and refuse to boot any firmware that is older than MF3.
    • The bootloaders are digitally signed such that replacing them with custom code will cause them to fail to load - causing hard bricks if attempted.
    • Without a custom bootloader, we have no hope of ever running other native-linux operating systems, Windows, or IOS. Emulation and "chroot" methods might still exist, but these are not the same.
    • Normally, recovery images and Kernels are signed, and must be verified by "aboot" (the last stage of the bootloader) upon boot. This makes booting a custom recovery or custom ROM "impossible."
    • Previous to MF3, Dan's Loki exploit worked around a security flaw in aboot. His patch would be applied to a custom recovery or a custom Kernel to allow it to be accepted by aboot.
    • Obtaining root will NOT grant us a custom recovery. This would require a completely separate exploit that would be similar to an unlocked bootloader, or an otherwise an exploit around the locked bootloaders (like Loki).
    • If you're looking for fully unlocked bootloaders, you're looking for the ability to fundamentally change the operating system on this android device. Granted, this would also allow custom recovery, or custom roms.

    I hope you find this information useful. Even more, I hope that a root for MF3 is found, for the benefit of everyone now stuck on MF3. It would be great to find a new exploit that allows custom recoveries and custom kernels again. But most important for me, would be unlocked bootloaders such that we can replace them with the bootloaders necessary to run things like native Ubuntu linux.