[GUIDE][I337UCUAMF3][STOCK][NEUTERED] MF3 OTA Update - Keep Recovery and Root! [7-12]

Search This thread

spdwiz18

Senior Member
If I'm not mistaken, there is a script somewhere in /system that will install recovery for you, so long as you put a new recovery file in the correct spot. I believe this is what the OTA update does in order to patch the recovery. This is probably because the OTA patch is applied technically through the stock recovery, and attempting to patch recovery directly while in recovery wouldn't work.

EDIT:

Probably related to these:

/system/recovery-from-boot.p
/system/etc/install-recovery.sh
/system/recovery.img

Check out this post here: http://xdaforums.com/showthread.php?p=43420188#post43420188

you would be correct. thank you responding to him, iv been busy at work.
 

Solange82200

Senior Member
Mar 27, 2009
404
49
Sorry for the dumb question, but I flashed a rom that is supposed to have all the benefits of the mf3 update without losing the ability to root and flash in the future. My question is, how come that rom can have both wifi and sound but doing it this way you lose one or the other? Is the rom I flashed missing something from the update or did I misunderstand what I was flashing? I'm just confused... Thank you for the hard work!

Sent from my SAMSUNG-SGH-I337 using xda app-developers app
 

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
Sorry for the dumb question, but I flashed a rom that is supposed to have all the benefits of the mf3 update without losing the ability to root and flash in the future. My question is, how come that rom can have both wifi and sound but doing it this way you lose one or the other? Is the rom I flashed missing something from the update or did I misunderstand what I was flashing? I'm just confused... Thank you for the hard work!

Sent from my SAMSUNG-SGH-I337 using xda app-developers app

If I'm not mistaken, they included a customized kernel that solves the wifi/sound problem. Otherwise, I'm not sure exactly what they did to fix the issue, but they clearly didn't mention it.
 
  • Like
Reactions: Solange82200

sam3000

Senior Member
Jul 11, 2009
365
421
Seattle
That would be cool if you can get the WiFi working for everyone, ;) If you do find a solution, please let me know and I will promptly update the OP.
--------

Also, it looks like the QPST method for fixing a hard brick WOULD work, but unfortunately, I don't have a Samsung-signed MPRG8960.hex file. If someone has that, please send it my way? (very doubtful)

It appears my only remaining option is to JTAG this thing. Ideally, I want to just JTAG the sbl2 and sbl3 if possible, but it looks like I might have to flash the whole boot chain to get it back to download mode.

Here's the questionable part: I've read up a small amount on efuses. It seems once you flash a newer version of a bootloader, you typically can't go back because it will reject anything older than its current increment (permanent). As far as I can tell, here's my current boot chain, with version numbers:

pbl = (stock, of course...)
rpm = MF3
sbl1 = MDB (no patches to-date have changed this)
sbl2 = MF3
tz = MDL
sbl3 = MF3
aboot = MDL

Now, I'm not sure if the chain of trust was violated when the sbl2 loads and authenticates TZ... or if things break when the sbl3 tries to load aboot? Either way, I'd like to just restore all of these back to MDB (or MDL even).

Question #1(ish): if I were to JTAG this, could I restore all of these back to an earlier version (does JTAG have such power)?
Question #2(ish): if I am now stuck with MF3 (a.k.a. need to update aboot & tz to MF3), can a JTAG be performed whilst keeping my /system and /recovery partitions in-tact?

If I can keep my current /recovery and /system, I don't think that I would mind losing Loki. I would just be stuck on the stock ROM forever. But if I had root & a custom recovery, I could still live with that. But I would still prefer to revert all of this back to MDB or MDL. :(

@AdamOutler or @connexion2005 - Can you please take a few moments out of your busy lives to answer some of the questions above? Adam, I know that you have a LOT of knowledge on the chain of trust, so you might be able to enlighten me(us) about what is broken here. Josh, you have a lot of experience JTAGing this device and hundreds (thousands?) of others. Can you provide some answers here?

Thank you both, and thank you everyone else for the input/info so far. If I can get this device back up and running, I will be happy to continue contributing my time and efforts into this project and some other S4 projects I have put on hold. :(

Once you (or someone) has JTAG access, you can physically flash anything you like. The only thing that's one way is the qfuses.

I sent my I337 to mobiletechvideos nearly a couple of months ago to jtag unbrick and Josh did a great job. They are able to restore single partitions at a time. (My device was completely lifeless after an unsuccessful attempt to shrink /system and move everything down to make /data bigger.)
 
  • Like
Reactions: 8649

fukenbiker

Senior Member
Jan 28, 2011
388
64
Los Angeles
lango.us
HAIL!

Once you (or someone) has JTAG access, you can physically flash anything you like. The only thing that's one way is the qfuses.

I sent my I337 to mobiletechvideos nearly a couple of months ago to jtag unbrick and Josh did a great job. They are able to restore single partitions at a time. (My device was completely lifeless after an unsuccessful attempt to shrink /system and move everything down to make /data bigger.)

You are a brave explorer that anyone could applaud! I read this entire thread and my hat is off to you. I hope you get your handset up and running again, after learning so much.

I am still feeling aloof because I was smart enough/lucky enough to use Titanium Backup to freeze the system app called "AT&T Software Update" and my build number ends with "MDL". Actually being clever/lucky enough to be where I am is a blessing. Most folks bumbling along out there will learn how useful/powerful "Root Explorer" is, and see how I use it to navigate all the books and manuals I have on my MicroSDcard in the expansion slot and be wanting to do the same thing, eventually. And eventually is now. And now they can't ever use Root Explorer because AT&T must hate Root Explorer, or heck I don't know, but I bet it has to do with money on the bottom line somewhere!

If you let the July 10 AT&T over the airwaves update PUSH through your Galaxy S4 you've had the big weenie. Your build number will end with the characters "MF3" and you can't use "Casual" or "motochopper". You are locked in an AT&T purgatory of not having complete control of the device that you will take possession of by reason of your two year contract.

If you do upgrade to this Samsung Galaxy S4 handset, be sure to review your AT&T data plan. I recommend at least visiting one of the lower level techs in an AT&T store that seems on the ball and honest, to get the best bang out of your buck. The wife and I watched our bill drop after the kid fixed our plan. He was attentive and figured us out after much discussion. I had to explain the trouble I had with trying to accomplish my objective by using the AT&T website, is when he lit up and helped me big time.

It's sad that everyone ignorant of xdaDevelopers who never heard of Adam Outler will be forever trapped in a disfunctional relationship with AT&T, Samsung, and Google, that provides too many unsatisfactory results toward using your handset as a full on computer replacement, which has been the apple of my eye for recent years in the development of Android.

Love this stuff!

I will return to CyanogenMod when they get the source code for the InfraRed port. I love the universal television remote in WatchOn. I will not give up this new toy, even though as a flashaholic I am really jone's'n' bad to flash just to flash.

Rather I'd like to see an app show up that would use the IR port to allow me to print directly to a Canon iP90v. I had bought that printer back in the day, because a Sony Ericsson (legacy flip phone era) hand set I had could print a picture without a computer. It worked great but the legacy flip phone became obsolete and so here we are today.

We still use this printer, it's plugged into a USB port on this desktop the wife and I use. I even have an IR adapter for a laptop in case we want it to use the printer, but we've resorted to sending files directly to the desktop that has the USB hard wired to this printer that has the far out IR red window on the side, that's not being used anymore, but could be in my opinion.

If your build number doesn't end with MDL you're either way behind and happy at MDB, or MF3 screwed to the power of three.

I am running stock/casual/twrp/root thanks Adam Outler, DrJBliss and the rest if I am missing a contributor, I beg pardon. I have yet to use the nandroid images I've created using TWRP. I suspect it's nothing out of the ordinary as I've used custom recovery like CWM to flash my back up image and return to stock. I have read enough and see evidence from folks like you that would validate me restoring my handset as though it were fresh out of the box. I have the 3.56 GB recovery file saved in the computer and on the phone twice. In the phone and also on the micro SD.

Again, thank you for exploring and reporting, and good luck restoring your handset, AOU.
Bless your brave exploration!
 

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
If I'm not mistaken, they included a customized kernel that solves the wifi/sound problem. Otherwise, I'm not sure exactly what they did to fix the issue, but they clearly didn't mention it.

After looking at it again, that's exactly what Scott did. He did a similar thing I did (neutered the OTA package), kept the MF3 modem out of it, and included some other kernel. That's exactly why it's not Lokified and you must flash Loki-Doki (it's the kernel that must be Loki'd if it isn't the stock kernel).

I'll see if I can add some steps here to the OP to do this on your own. Should be fairly easy, and it sounds like it will fix the sound/wifi issues entirely. It seems that the sound/wifi issues are certainly in the stock MF3 kernel - it needs something from the MF3 bootloaders, but those are too risky to flash.
 

Aou

Senior Member
Aug 4, 2008
794
778
Arizona
...
Again, thank you for exploring and reporting, and good luck restoring your handset, AOU.

I appreciate the encouragement. Unfortunately the device is more-or-less perma-bricked. The best I *might* be able to do with it is get it upgraded fully to MF3 - at which point it will likely never have root or a custom ROM again. This was the determining factor for moving forward with replacing the device. The new device still has MDL, so I'm good-to-go again.

Again, thanks for the kind words.
 

prime3045

Senior Member
Dec 5, 2012
186
25
New delhi
pls help

Hey everybody I am on at& t sgh i337 4.2.2 I337UCUAMDL can I use the Unadulterated update zip on the first page ? I am on indian carrier (tata docomo). Pls advise and if possible give instructions for update.
Also will I lose my installed apps and data??
 

v941726

Senior Member
Jun 7, 2010
1,803
195
Rochester NY
Samsung Galaxy S22 Ultra
Hey everybody I am on at& t sgh i337 4.2.2 I337UCUAMDL can I use the Unadulterated update zip on the first page ? I am on indian carrier (tata docomo). Pls advise and if possible give instructions for update.
Also will I lose my installed apps and data??

Yes. You need to go back to 4.2 and wipe everything . Don't forget Loki and if you can't reboot into recovery, hold down the power up button power key and count to 4. Then let go. Keep pulling the battery till you get the timing right. Not 4 seconds, just count to 4
 

prime3045

Senior Member
Dec 5, 2012
186
25
New delhi
Yes. You need to go back to 4.2 and wipe everything . Don't forget Loki and if you can't reboot into recovery, hold down the power up button power key and count to 4. Then let go. Keep pulling the battery till you get the timing right. Not 4 seconds, just count to 4

Were you referring to me?? If yes then whats loki?? And I am already on 4.2.2 so go back to 4.2 isn't making any sense! Pls elaborate
 

v941726

Senior Member
Jun 7, 2010
1,803
195
Rochester NY
Samsung Galaxy S22 Ultra
Were you referring to me?? If yes then whats loki?? And I am already on 4.2.2 so go back to 4.2 isn't making any sense! Pls elaborate

Yes. I was referring to you. I did mean 4.2.2. I meant loki-doki to flash after you upgrade and before you reboot. I was assuming you knew. But that's ok. If you're a newbie, I will help.

So with 4.2.2, you are good to go. I assume that you're rooted and unlocked too.
 
Last edited:

prime3045

Senior Member
Dec 5, 2012
186
25
New delhi
Yes. I was referring to you. I did mean 4.2.2. I meant loki-doki to flash after you upgrade and before you reboot. I was assuming you knew. But that's ok. If you're a newbie, I will help.

So with 4.2.2, you are good to go. I assume that you're rooted and unlocked too.


Thanks for supporting
No I haven't rooted I am on stock (didn't do for update)
What I have to do now and exactly which update I have to download?
 

prime3045

Senior Member
Dec 5, 2012
186
25
New delhi

Attachments

  • Screenshot_2014-04-02-11-49-02.png
    Screenshot_2014-04-02-11-49-02.png
    140.9 KB · Views: 158

Top Liked Posts

  • There are no posts matching your filters.
  • 24
    Notice (4/16/14): I'm no longer here. I've said "goodbye" to AT&T and their locked bootloader schemes. I'm voting with my wallet - I've sold my I337 and switched to T-Mobile. My apologies to the community, but you're now on your own here.

    NOTICE: These instructions are pretty much obsolete. If you'd like to run a pure stock MF3 rom based on this exact method of neutering the MF3 OTA update, then read this thread. This thread shall remain for informational purposes only.


    A quick THANKS to djbliss (motochopper root exploit), TeamWin (TWRP recovery), Chainfire (SuperSU), and all of the Guinea pigs that tested some of this stuff out for me in this thread.

    What is this?
    This is not technically a ROM, but by the time you are done, you will be running the stock, (albeit rooted) I337UCUAMF3 ROM provided by AT&T. Unlike the original MF3 OTA patch, if you perform the steps outlined in this thread, you will not lose your custom recovery, and your bootloader (including aboot) will remain untouched.

    Here's what the neutered version does:
    • It will flash a new boot.img, which primarily includes the MF3 Kernel.
    • It will flash the RPM partition, which as far as I can tell is strictly for power management. I kept it in the package because it seems harmless.
    • It will update many files in your /system partition, bringing you up to the latest MF3 build (the whole point).
    • It will flash the new MF3 modem/Baseband, along with its counterpart, the NON-HLOS partition as well. The NON-HLOS partition will cause some problems with your sound (keep reading), but I've added a patch here that will solve this problem while creating another (WiFi breaks). I've kept this included in the original neutered patch, just in case someone is able to find a very easy fix for the sound and/or WiFi.

    Can I go back?
    From my experience, if you do not update the bootloaders, it is fully possible to return to the I337UCUAMDB or I337UCUAMDL stock versions. I used Odin, personally, but you could simply restore nandroid backups or flash a new rom. Your modem/Baseband will stay at I337UCUAMF3, along with your RPM partition - unless you use Odin or otherwise flash older versions manually. Personally, I found ZERO side-effects of performing these steps and then restoring my MDL-based nandroid backup.


    Bugs?
    At this time, you will have to choose between either having sound, or having WiFi. Can't have both. This is completely related to the NON-HLOS modem that's included and expected in the MF3 build. As mentioned above, the new NON-HLOS modem will kill your sound capabilities without having the new bootloaders, etc. I have no idea why, so I've provided a "fix" for this - a flashable .zip that will restore your NON-HLOS modem back to the MDL version. If you revert to this MDL NON-HLOS modem, you will lose WiFi capabilities. If someone finds a more proper fix for this, please let everyone know. Otherwise, you're welcome to keep switching back and forth as you please. See the section in this post about flashing just the modems.


    Anything else?
    In addition to all this, I've provided a modified, deodexed SecSettings.apk that will not scan for SysScope and will not mark your system as "Custom". This add-on package also removes SysScope entirely from the OS. This add-on optional, and you can choose not to flash this part if you wish. This package is based on my previous mod, located here (some minor changes in Status.smali to match the new MF3 build, but otherwise the same steps were performed to create this new SecSettings.apk). Basically, if you perform all of the steps outlined in this method, you will find yourself with an "official" status, and will have the original "Galaxy S4" boot logo (not the custom/padlock logo), regardless of the root or custom recovery.


    Warnings and Caveats:

    I have not extensively tested the I337UCUAMF3 operating system, and I WILL NOT be providing tech support for this operating system. Take it AS-IS, and ask your questions about the OS in the Q&A forum. This thread will be only for the process of getting you to I337UCUAMF3.

    NOTICE: This is only intended for the I337 - a.k.a. the AT&T Galaxy S4. I have only tried this on my 16Gb, original device. You may try it on other devices, but there is of course a very high risk of bricking your non-i337 device. You've been warned.

    WARNING: I am not responsible if you brick your device. Follow the instructions very, very closely, and you will be fine.

    ANOTHER WARNING: There are mixed reports about certain things being broken with the MF3 update, such as the "free unlock with hidden menu" and tethering, etc. If these are important to you, you might want to make a full backup of your EFS just in case. Most custom recoveries (including the provided TWRP recovery) can help you do this. The EFS partition does not appear to be touched during the update, but just in case the new kernel or new modem does something to it on-the-fly, it would be a good idea to have a backup.


    Okay, great. So what do we do?
    Click the "Click to show content" button below to begin.

    1. Download all these prerequisites. Get the downloads started now, and just read-ahead so you are familiar with the next steps.
    2. Put each and every one of these downloads onto the root of your internal SDCard (/sdcard/).
    3. Make a full Nandroid backup of your device - include system, data, and everything.
    4. Make a backup of everything that is on your internal SDCard - it's possible to accidently wipe it.
    5. Wipe data. Be careful not to wipe your SDCard!
    6. Odin to stock, unrooted MDB package. Instructions here.
    7. Allow the device to reboot fully into the clean, stock MDB. This will clear your "Custom" status, by the way.
    8. When returning to MDB, some apps will likely force-close when they start. This is due to data problems with these apps. You could wipe data again to remove these, but there is risk of wiping your SDcard if you do it wrong. Otherwise, just clock OK and get through them all before continuing.
    9. Run Motocopper - Use custom version that I've provided, OR you can download the original version here http://xdaforums.com/showthread.php?t=2252248
      NOTE: If you use the original version, be sure not to allow it to restart your device! At the end when it prompts you to "Press Enter to reboot..." - DO NOT REBOOT.
    10. Install a custom recovery using your ADB shell. Do NOT mistype the partition number at the end, or you can easily hard-brick your device.
      Code:
      # dd if=/sdcard/openrecovery-twrp-2.6.0.0-jflteatt.img of=/dev/block/mmcblk0p21
      # reboot recovery
      Note: You should be able to use your own recovery. You will need to install it using the method above, however. Programs like GooManager will not work at this stage.
    11. Allow the device to reboot directly into recovery. Do not leave recovery until instructed to do so.
    12. Flash MDL-noSecure.zip
      NOTE: This is the original AT&T I337UCUAMDL update, but with the "ro.secure" check removed, and the recovery removed. Otherwise it is the same thing.
    13. Flash MF3-Neutered.zip
    14. Flash UPDATE-SuperSU-v1.41.zip
    15. Flash remove-SysScope.zip
      NOTE: This package will also clear your dalvik cache, just in case.
    16. Flash modem-fix.zip
      NOTE/BUG: If you skip this, you will lose all audio. If you flash this modem-fix, you will lose WiFi. Currently working on investigating this!
    17. Wipe Data/Cache.
    18. Reboot the device into system.
    19. Enjoy I337UCUAMF3.
    20. Click the "Thanks" button if this has helped you. ;)

    But I only want to flash the new modem (Baseband). Do I have to do all that crazy stuff?
    Certainly not! You can flash just the modem itself, very easily. You need to be rooted, or have a custom recovery first.
    The Manual Method - requires root (advanced users, but technically easier and quicker!):

    1. Download the .zip I created of all the modems I've ever had here.
    2. Make a nandroid backup for safekeeping. Note that a nandroid backup will not typically backup your current modem - this is just a precaution in case you mess things up and have to use Odin to restore your modems or something. Better safe than sorry!
    3. Unzip contents to your sdcard.
    4. Fire up your ADB shell.
    5. Type the following very carefully. DO NOT GET THE PARTITION NUMBER WRONG or you could easily brick your device. Badly.
      Code:
      su
      dd if=/sdcard/modem-MF3.bin of=/dev/block/mmcblk0p2
      reboot
    6. Start testing it out!

    NOTE: The included NON-HLOS.bin is intended for mmcblk0p1. If you are on an MDL-based ROM and/or Kernel, don't flash this file yet, unless you're being experimental. Here's why:
    If you have an MDL-based ROM/Kernel... said:
    If you have an MDB NON-HLOS.bin and an MF3 modem.bin, Wi-Fi will break.
    If you have an MF3 NON-HLOS.bin and an MF3 modem.bin, sound will break.
    If you have an MDL NON-HLOS.bin and an MF3 modem.bin, .... Nothing seems broken. Sound and Wi-Fi are working.

    The Automatic Method - requires custom recovery (recommended for flashaholics):
    CPA Poke has offered a flashable version of the modem as an option here.


    I just want the original, unaltered I337UCUAMDF patch. Where can I find it?
    You can download it here. This was taken straight from \cache\fota\2400258.cfg. You can rename it as a .zip if you'd like to mess with it. Please note that this file may not be flashable on your device if you have customized your /system partition or have made other modifications to your device. This patch performs a series of integrity checks, and will not install if it fails any of them. If it fails, you should be safe, as the patch sequence aborts before making changes if it fails the checks.

    BE FOREWARNED: Flashing this file directly will cause you to lose root, lose your custom recovery, and lose the ability to obtain root in the future (as far as we know). In other words, DO NOT install this unaltered, original update if you EVER want to have root again, flash custom ROMs, or have the ability to make/restore nandroid backups. You've been warned.


    How can I make my own neutered version of the OTA patch?
    Check out post #2 in this thread for all the details on how to customize your OTA patch file, including the warnings and potential ways you can hard brick your device.


    What was changed in this patch?
    If you were to flash the original patch without neutering it first, you'll be stuck with a stock MF3 build (or higher). As far as we can tell, this patch does blow some e-fuses in the device, incrementing a number such that it is impossible to return back to an older build (MDB or MDL). There is currently no known cure for this condition if this is the case, especially considering we have locked bootloaders on the I337 at this time.

    For a complete list of all the files that this patch touches on your system, you can check out my previous post here.


    Can I use this in my own ROM?
    Certainly! In fact I encourage it. I'd like to see some cool ROMs be built using the MF3 base. It's got some nice improvements on the MDL base, so any stock-based ROMs should benefit. You have my full permission to use this complete process or any parts/pieces/packages/methods herein. I would like to see my name mentioned in your "thanks" list if you have one, but this is of course completely optional.


    Where can I download a full system and kernel dump of the work you did? (ADDED 7-12-13)
    You can download it right here. Apart from the SysScope mod mentioned above and injecting root, this is the full, stock image. This is NOT directly flashable, so don't even try. This will only be useful for ROM developers and advanced users. The modems and bootloaders have nothing to do with these packages, but these might be required for everything to work correctly (i.e. sound and WiFi).

    This was created from my device after performing all the steps above, using these commands while the device was in recovery, from a root ADB shell:
    Code:
    dd if=/dev/block/mmcblk0p16 of=/sdcard/system-MF3.img
    dd if=/dev/block/mmcblk0p20 of=/sdcard/boot-MF3.img


    Do you have this available as a ROM I can flash? (ADDED 8-6-13)
    Indeed! If you want to install this as a ROM, check out my newer thread here.

    Anything I can do to help here?
    If this information and tutorial helped you out, just simply hit the "THANKS" button. It's great to know the work was appreciated. Another way that you can help is to provide feedback in this thread about how it worked for you, and if there's any improvements that can be made. Lastly, if you're interested in helping financially to help recover the costs of the JTAG box I now need to recover my S4, you're certainly welcome to assist by using the donate link on the left. Keep in mind that I'm not technically a Dev here - I'm just another forum member that's providing information to other members. It's what this whole community is about.
    3
    How can I make my own neutered version of the OTA patch?
    With lots of careful snipping. But first, you need a copy of the original OTA patch. You can download this from my post above, or you can download one yourself straight from AT&T.

    To download your own copy, the process is not terribly complicated - just risky. Here's the steps I performed to obtain the original update file from AT&T:
    1. Make sure you have root before continuing. If you screw this up and allow the update to install, you're pretty much SOL.
    2. If you are running the stock MDL rom, you can simply launch the updater in Settings -> More... -> About device -> Software update and let it download. Just don't reboot your phone until you've then frozen the AT&T update applications (all 3 of them) from performing the update. Keep in mind that your device will eventually reboot on its own, thanks to AT&T and their way of forcing updates.
    3. Pull the update file from /cache/fota/2400258.cfg, and put it somewhere on your computer that you can work with it. It's just a .zip file in disguise, so you can simply rename it appropriately.
    4. Delete the original .cfg from the device.
    5. As mentioned, freeze or disable the updater applications.
    6. You now have your own copy of the OTA update.
    Great - you've got the file. Time to grab the scissors and perhaps something to steady the hands and numb the pain. A keyboard works too in this case. Here's what to do:
    1. Save a backup copy of your update file. One copy for safekeeping (in case you want to start over) and another to work on. Do it now.
    2. Open the update file using basically any .zip editor. I used 7zip because it performed quickly, whilst Win7's zip capabilities were VERY SLOW dealing with this file.
      [*]From the root directory of the file, delete:
      • aboot.mbn
      • sbl2.mbn
      • sbl3.mbn
      • tz.mbn
      • The entire "recovery" directory.
    3. Within the file, browse to META-INF\com\google\android and pull a copy of the updater-script. This file does all the magic.
    4. Edit the updater-script using a text editor, preferably something like Notepad++ (great program! I recommend it). Make the following changes:
      • Remove the following line:
        Code:
        assert(getprop("ro.secure")=="1");
      • Edit the following line from:
        Code:
                         "/system/tts/lang_SVOX/svox-lh0pt2en-US22.pil",
        to
        Code:
                         "/system/tts/lang_SVOX/svox-lh0pt2en-US22.pil");
      • Remove the following line (it's right after the last one you edited):
        Code:
                         "/system/recovery.img");
      • Remove the following lines:
        Code:
        delete("/system/recovery-from-boot.p",
               "/system/etc/install-recovery.sh");
        and remove:
        Code:
        ui_print("Unpacking new recovery...");
        package_extract_dir("recovery", "/system");
        and remove:
        Code:
        set_perm(0, 0, 0544, "/system/etc/install-recovery.sh");
        and remove:
        Code:
        ui_print("Update sbl2 ota");
        assert(write_backup_fota("/dev/block/mmcblk0p4", "/dev/block/mmcblk0p22"));
        assert(package_extract_file("sbl2.mbn", "/dev/block/mmcblk0p4"));
        assert(erase_backup_fota("/dev/block/mmcblk0p22"));
        ui_print("Package sbl2 Done.");
        ui_print("Update sbl3 ota");
        assert(write_backup_fota("/dev/block/mmcblk0p5", "/dev/block/mmcblk0p22"));
        assert(package_extract_file("sbl3.mbn", "/dev/block/mmcblk0p5"));
        assert(erase_backup_fota("/dev/block/mmcblk0p22"));
        ui_print("Package sbl3 Done.");
        ui_print("Update aboot ota");
        assert(write_backup_fota("/dev/block/mmcblk0p6", "/dev/block/mmcblk0p22"));
        assert(package_extract_file("aboot.mbn", "/dev/block/mmcblk0p6"));
        assert(erase_backup_fota("/dev/block/mmcblk0p22"));
        ui_print("Package aboot Done.");
        and remove:
        Code:
        ui_print("Update tz ota");
        assert(write_backup_fota("/dev/block/mmcblk0p8", "/dev/block/mmcblk0p22"));
        assert(package_extract_file("tz.mbn", "/dev/block/mmcblk0p8"));
        assert(erase_backup_fota("/dev/block/mmcblk0p22"));
        ui_print("Package tz Done.");
    5. Save it, and put the modified updater-script back inside the update file where you found it, replacing the old one.
    6. Upload it to your SDCard and flash. See all the warnings here in this post and in the original post about what to do with this thing.

    NOTES and WARNINGS:
    • A careful reader will be able to easily tell what each part of the updater-script does, and you can choose whether or not to keep it, modify it, or delete it.
    • Keep in mind that the update will fail if it does not pass all of those integrity checks. You can technically remove all of the integrity checks, and the update will still process, patching files left-and-right. However, depending on how heavily you have modified your system, you will probably run into extreme problems (soft brick most likely).
    • CRITICAL WARNING ABOUT BOOTLOADERS: At this time, do NOT allow the update package to only partially update your bootloader! Failure to update the entire bootloader will result in a hard brick. For example, if you were to include the parts that update sbl2 and sbl3, but not include tz and aboot... your chain of trust will be violated, and the device will refuse to boot normally (a.k.a. QDL Mode or Emergency Boot). The only theoretically known way out of this is JTAG. You don't want to go there. So, simply put: regarding bootloaders, it's all or nothing. The bootloader updates included in this package are: sbl2.mbn sbl3.mbn aboot.mbn tz.mbn. It's like any good D&D campaign - if you separate these party members, the campaign is toast.
    • REMINDER: At this time, it appears that flashing the new bootloader will trip an e-fuse. This is a hardware device that is only capable of incrementing a number. If the number on the e-fuse is higher than the bootloader you are trying to flash (with Odin, for example), the device will refuse to take the update. In other words, if you flash the MF3 bootloader, there is no known way to return to the MDB or MDL bootloaders at this time.
    2
    Interesting. Did you odin back to MDB stock or MDL stock? If you happen to have the MDL Odin (I still don't know where to find that?), then you'll probably get errors at that stage.

    It's likely possible to do things in a slightly different order and skip some steps if you have the MDL Odin package. Otherwise, I posted what worked for me with what I had. ;)

    I have an mdl odin if you need one or you can get it from sammobile.com
    But they are really slow.

    Sent from my SAMSUNG-SGH-I337 using xda premium
    2
    Careful flashing too many parts of that update! Last night I updated sbl2 and sbl3. Hard brick. Still troubleshooting today to see if I can get anything over UART, but it looks pretty hopeless. Currently I have no JTAG either. Perhaps someone like @AdamOutler could point me in the right direction? Looks like I need to get a JTAG adapter for the S4, and a riffbox or something. At least I pulled a copy of my original sbl1, sbl2, sbl3 and aboot before I bricked it.

    If you're strictly following the guide, no problems. If you decide to create your own neutered package, be very careful regarding which parts you allow it to flash.

    I must have interrupted this chain of trust thing that Adam speaks of. :p
    1
    Nice...as usual. Just to help make it clear, are you allowing other developers to use this to put into their ROMs (with credit given of course)?

    Again, thanks for your work.