[BOOTLOADER] Locked bootloader research and news [Updated: 7/16/2012]

Search This thread

alexcolodner

Senior Member
Jan 31, 2011
194
258
Brooklyn
Just a quick question I have my phone now and I'm debating on activating it but I'm curious the ONLY thing affected by the locked bootloader is the kernel correct? We can still flash roms and radios correct?

Correct. And there are workarounds in place for flashing custom kernels which have been working fine. Unlocking bootloader would just make things easier. Not sure about radios.
 

Neverendingxsin

Senior Member
Dec 21, 2009
2,173
1,182
Virginia

Neverendingxsin

Senior Member
Dec 21, 2009
2,173
1,182
Virginia
don't let that keep you from activating. This is a great device!

Sent from my SCH-I535 using Xparent ICS Tapatalk 2

believe me i want to activate it, but i also paid full price so getting the developer one is no big deal i just don't want to wait. Im just worried it'll end up like my thunderbolt and have ril issues which stop development down the road
 

Neverendingxsin

Senior Member
Dec 21, 2009
2,173
1,182
Virginia
Yup, but since i have no idea when the developer phone will come out id rather just use this one, but for development and long term sake i dont want anymore radio problems, thats the biggest thing i had about the thunderbolt. Im fine with using kexec for kernels and all that.
 

nosympathy

Senior Member
Dec 19, 2010
2,769
1,257
Cincinnati
Thanks for the quick replies. Radios are my biggest concern especially since I'm coming from a thunderbolt

I think we can. I could be wrong but I thought some of the guys with the newer phones with the updated stickers were flashing our current release stock image and it was downgrading their baseband. Not 100% though, as it was posted in General section. Maybe someone with an "updated" phone can answer this for us?
 

crazydad

Senior Member
May 25, 2011
221
15
Virginia
ok so i just bought the s3 at VZW and it has the updated sticker. i wat to root it and install a recovery. where can i find how to root and if i can even root it < cause it has been updated for me me>. any help would be cool. i have looked AT The root post but it says dont use this if you have the update. thanks for the help
 

Sniper_5

Senior Member
Aug 11, 2010
213
30
36
Manheim
Does your info look like this? If so, your fine to Root. I flashed Root_66 via Odin with no issues what-so-ever.

Sent from my VZW SGS3
 

Attachments

  • uploadfromtaptalk1342846236649.jpg
    uploadfromtaptalk1342846236649.jpg
    54.4 KB · Views: 978

bbolton_98

Senior Member
Mar 3, 2008
232
48
Pensacola
Samsung Galaxy S20
Question my sIII info is different, than what's posted in screenshot above. Is this what most of us have or will it be of any use to helping with bootloader work?

I'm stock unrooted, no updates that I know of haven't touched root or anything yet.

Thanks to all the dev's.
bbolton_98
Sent from my SCH-I535 using Tapatalk
 

Attachments

  • uploadfromtaptalk1342864755870.jpg
    uploadfromtaptalk1342864755870.jpg
    33.8 KB · Views: 780

kzoak82

Senior Member
Jan 27, 2011
221
27
Holy god has this turned into a junk thread...

Sent from my DROID RAZR MAXX using xda premium


I agree aren't there another threads about "random thoughts" or the specific topics being posted here? I check this for relevant updates and for the last couple of days all I read about is how Johnny can't find the camera or Daisy doesn't like the white s3 and would rather have a pink one.......

Sent from my SCH-I535 using xda premium
 
  • Like
Reactions: Poloasis

Top Liked Posts

  • There are no posts matching your filters.
  • 67
    Invisiblek succesfully booted to android using "adb reboot recovery" with his modified recovery.img.

    Basically we made it look as if going to recovery, but actually continuing onto boot.img.

    thats not 100% accurate

    i flashed a modified boot.img to our recovery partition (/dev/block/mmcblk0p18)
    then rebooted into recovery
    it booted up into android using this modified boot.img

    i don't plan for this to be of any real use to us though. proof of concept really

    we need our access to /dev/block/mmcblk0p7 (where our stock boot.img actually resided)

    thing is, we can flash to mmcblk0p7 just fine, but it wont boot (wont do anything actually other than let you get back into odin mode, where you can re-flash the stock boot image, or it gives you this when you try to boot android or recovery: http://i.imgur.com/Ci0gY.png )

    rest assured. this is being worked on...
    39
    Since this is a news thread...

    It was reported in IRC within the past hour or so that supposedly BOTH kexec is likely working and noobnl (whom many of you may know from his work with AOSP ROMs) has stated that the RIL has been cracked :D

    To those who don't know what that means, kexec chainloads kernels (in simplest terms, the custom kernel loads on top of the stock kernel AFTER the bootloader checks to make sure the stock kernel has been unmodified). This was necessary if one wanted to run a non-Touchwiz ROM (such as CM, AOKP, etc) or if they just wanted to run an overclocked, undervolted kernel.

    The RIL is essentially the radio. It was also needed to run a non-Touchwiz ROM and now opens the door to Jelly Bean ROMs.

    There is still working/testing to be done, and there are no ETAs, so don't bug the devs. They're actively working on it so let them do their thing.

    What a roller coaster of a weekend :)
    36
    Since locked Verizon SGS3 is now the main problem, i'v decided to split my kernel thread to separate one that focus directly on unlocking bootloader and progress in that matter.

    Summary of the problem

    Verizon model is protected from flashing unsigned/modified boot.img and recovery.img. Which means there is no known root method as for now for SCH-I535.
    And that is where our adventure starts ....


    Rooted stock boot.img issue:
    <ID:0/008> Firmware update start..
    <ID:0/008> boot.img
    <ID:0/008> NAND Write Start!!
    <ID:0/008> FAIL! (Auth)

    CWM Recovery.img flash issue:
    <ID:0/003> Firmware update start..
    <ID:0/003> recovery.img
    <ID:0/003> NAND Write Start!!
    <ID:0/003>
    <ID:0/003> Complete(Write) operation failed.

    Research status: 50%
    + 20% - Some devs stated that RIL is hacked and there is also sucessfull Kexec implentation in works - http://xdaforums.com/showpost.php?p=28484191&postcount=262 Stay tuned for more news. Kexec proof-of-concept thread: http://xdaforums.com/showthread.php?t=1760678
    + 20% - phone can boot from unsigned boot.img flashed to recovery partition, this will leave you without recovery and requires to boot-trough-recovery every time u rebooting phone! (thanx invisiblek)
    Links: http://xdaforums.com/showpost.php?p=28420589&postcount=47 , http://pastebin.com/eARk7r48

    + 10% - phone rooted trough system.img tricks -> http://xdaforums.com/showthread.php?t=1756885 (by invisiblek)


    ROM analysys:
    boot.img -> signed
    recovery.img -> signed
    system.img -> not signed
    cache.img -> not signed

    Update [7/7/2012]
    News about locked Verizon model is spreading over the websites and main tech-related portals. Hopefully we will get some detailed info soon.

    Update [7/7/2012]
    It looks like it has been rooted by using system.img trick (system.img is not signed)
    http://xdaforums.com/showthread.php?t=1756885
    Enjoy! and thanx to invisiblek :) good job!

    Update [07/15/2012] VZN insider confirmed this is not a true info
    One of thread members chatted with verizon reps over mail & chat and got info that there may be possible unlocker released for bootloader at vzn locked phones. Here's the screenshots of chat: http://i.imgur.com/0lX3o.png , http://i.imgur.com/ULA4X.png
    At this is not confirmed yet officialy, it may be interesting finding.

    Update [07/15/2012]
    Adam Outler posted he's own research info in separated thread, read it. It may help a bit -> http://xdaforums.com/showthread.php?t=1769411

    Update [07/16/2012]
    Galaxy S III Verizon Developer edition shows up on Samsung Website! -> http://www.samsung.com/us/mobile/cell-phones/SCH-I535MBCVZW


    Thanks!
    29
    Developing right now:

    JackpotClavin and Invisiblek have successfully loaded a custom kernel using a modified recovery ramdisk. It's still very early but this is excellent news for us. As it stands, this method wipes ClockworkMod and requires the recovery key combination on every boot, but those issues can probably both be overcome with custom scripts.

    Stay tuned guys...and mash those two guys' Thanks buttons!
    24
    hmmmmm kind of like your post was right?

    And your post also.

    On a good note while i was digging around last night through the source code I did notice something really nice about the SGSIII that should make you all very happy. As the guys at epic have noted, the kexec flag is marked, meaning that kexec can crash the existing kernel with one of its own. Now what does that mean you may ask. I'm glad you asked.

    For those of you that do not know there are 5 primary partitions that are contained on most phones and android devices:
    1. X-Loader
      This partition is usually the partition with the most basic hardware inits such as base gpio (buttons) and power toggles​
    2. bootloader
      This is the partition that contains what most of us as dev's hate the most, the dreaded boot signature, and boot instructions. When a bootloader is locked down it can be because of either a hardware lock, see OMAP4 processors Sec_On Pin, or a software lock, HTC's S-Off. When a bootloader is said to be locked, it can have two reasons for this, a signed header or an encryption algorithm on the entire partition.​
    3. recovery
      This partition is the one every one loves to see Clockwork Mod on. When not signed the partition can be flashed and used. ONE THING TO NOTE HERE IS THAT WHEN YOU USE THIS THREAD, YOU ARE SHOWING THAT THIS IS NOT SIGNED, Or the signature is not checked!!! This is intersting because it its self may show a security hole. The recovery might be what checks the CWM recovery flash images signature.​
    4. boot
      Perhaps one of the most interesting partitions on android devices. The boot partitions contains the binary for the kernel, and the inframs for the initilization of the os. This partition in this case has said to be signed, with a signature check in the bootloader that checks the validity of a boot partition, meaning there is no changing this.​
    5. system
      Contains most of the information on the OS. At this point all the framework and android settings get loaded. This partition is not signed, meaning we can modify to our will​
    6. userdata
      Contains the userdata, such as games and such​

    Now one thing to note is that there are two initialzation points, the first of which occurs in the boot parition and the second of which is in the system's /etc/init files. One thing that i would be interested in seeing is if you were to use this place to load in a new partition or an SD OS. for example:
    system1 partition init:
    Code:
    kexec -l /sdcard/kernel --reuse-cmdline --ramdisk=/sdcard/ramdisk
    system2 partition can then have an init that mounts a block partition from the sdcard onto the system partition.
    Code:
    mount /dev/block/mmc1... /system

    Now what does it all mean? This current method means that we can reload a compleatly new os onto a devices kernel and all. AKA Jelly Bean.

    For those dev which hope to find a way to make it work i point you to the following posts:

    2nd-init can be used for a second init after the first one to allow for kexec to be run (might not need this)

    kexec for ARM I might have to modify some kernel memory allocation issues but it should work none the less with the flag.