[GUIDE] Unlocking the Galaxys S5 Bootloader using DEV Bootloader [KK-MM]

GeTex · Mar 16, 2016

The S5 Bootloader Unlock is here! Huge thanks to @beaups for the research and sourcecode and tool, @ryanbg for researching this method in the firstplace, @autonomousperson For compiling the source to a app for us all, @haggertk for his CID and aboot! @jrkruse for innovating methods, one click apps, and MM methods @magic_man185 for recompiling the binary to disable SD requirements for MM, and everyone else for being patient for me being slow! Also thank you all for being a great supportive community!

I Have Updated the OP

Hoping this is less messy and hopefully neater to deal with

DO NOT ASK ABOUT ROMS, KERNELS, OR OTHER THINGS. THIS IS ONLY FOR UNLOCKING THE BOOTLOADER. WE WILL LAUGH AT YOU IF YOU ASK ANYWAYS!!!

EMMC 15 Unlocking Bootloader

https://xdaforums.com/t/2021_vzw-em...er-unlock-ql1-rom_simply-aio-process.4009089/

EMMC 15 Updating Unlocked Bootloaders Or Downgrading

https://xdaforums.com/t/2021_vzw_em...-upgrade-marshmallow_lollipop_kikkat.4010757/

For Rooting EMMC 11 Phones

https://xdaforums.com/t/2021_vzw_lo...nrooted_roms_with_safestrap_mm_ll_kk.4182491/

All the methods below are only preserved for historical purposes!!! Please use the new methods above!

Notes:

If You Bricked Your Device somehow someway

If you have issues flashing modems, firmware, or anything

jrkruse said:
Ok here is the solution
The Stock Boot.img and Stock Recover.img that match your firmware must be flashed before any firmware can be updated on your phone. What I mean by firmware is the things other than images that are flashed in odin like the modem.bin. If your just wanting to flash a custom boot or recovery image then you can just flash them you and dont need to do any of this.
So after the Stock and Recovery images are flashed the phone needs to return to a power off state. Then a reboot to stock recovery and wipe the cache. Then reboot the phone and the goto bootloader mode from there.
After doing this the phone will allow firmwares to be flashed through odin.

Instructions
Flash the Kernel_Recovery Only either odin package or zip package in custom recovery
If using Odin uncheck reboot now then flash Kernel_Recovery package pull battery Reboot to recovery (Pwr+Hme+VolUp) wipe cache reboot phone then reboot back to bootloader and flash whatever your wanting to upgrade.
Reboot phone make sure your changes applied the you can flash your custom recovery again
If Flashing In recovery, flash the zip then reboot to recovery which will now be stock recovery and wipe cache and then power off Do not reboot, the phone must go to a poweroff state
Reboot phone then reboot to bootloader and use odin to update what ever your needing to do
Reboot Phone make sure your changes took. Then reboot back to odin and flash custom recovery or use flashfire or safestrap to flash the custom recovery zip.
If for some reason the bootloader becomes locked again simply do the unlock procedure again

https://www.androidfilehost.com/?w=files&flid=53300

To make the SD card usable again, format using android!
Or keep it as a backup

IF YOU FLASH STOCK BACK TO THE PHONE, IT WILL RELOCK THE BOOTLOADER, Requiring your run the script ONCE and it will be unlocked again

Source Located @ https://github.com/beaups/SamsungCID

beaups said:
its done

If any bounties applicable, please donate to "make a wish foundation" or @ryanbg (he's getting married)

--beaups

Sourcecode
https://github.com/beaups/SamsungCID

eMMC 11 is non-exploitable

http://xdaforums.com/verizon-galaxy-s5/development/toshiba-11-series-bootloader-unlock-t3349346

jrkruse · Mar 16, 2016

Updated 04-08-23!!

https://xdaforums.com/t/2023-emmc_1...ages-allowing-custom-roms-to-be-used.4182491/

EMMC_11 S5 phones now have an explot that allows flashing custom boot and recovery images giving the ability to run custom AOSP based roms such as Lineage and root with Magisk root on android 6.0 bootloaders. It is not a bootloader unlock so no custom images can be flashed with odin

Hariiiii · Mar 16, 2016

jrkruse said:
It doesn't work dev bootloaders are specific to the phone they don't work on other phones even other dev phones

I read in another forum somewhere about someone editing a hex value in a kernel to allow it to be loaded by odin (I think by changing some kind of version or product number). I expect if a VZW dev edition bootloader is specific to the phone, it incorporates some kind of IMEI or ESN check. Maybe it's possible to change that in the bootloader? Or perhaps it would work by spoofing the IMEI of the phone?

blair.sadewitz · Mar 16, 2016

I think it's some kind of shared key encryption and that won't work

GeTex · Mar 16, 2016

Going to take a peek then, I need a bootloader dump please? Anyone got a Dev Edition GS5?

Knowing verizon it's got a boot signature key probably with Secureboot. Damn

If thats the case, Another dead end?

Bobcus Leper · Mar 21, 2016

GeTex said:
Going to take a peek then, I need a bootloader dump please? Anyone got a Dev Edition GS5?

Knowing verizon it's got a boot signature key probably with Secureboot. Damn

If thats the case, Another dead end?

Would this help?

https://docs.google.com/file/d/0B8a454A1K5eOSEJFMEZTUmMyeTg/edit

Sent from my Motorola XT912 using XDA Labs

Hariiiii · Mar 23, 2016

Bobcus Leper said:
Would this help?

https://docs.google.com/file/d/0B8a454A1K5eOSEJFMEZTUmMyeTg/edit

Sent from my Motorola XT912 using XDA Labs

Unfortunately, no. That only includes the kernel and ROM itself. What we need is an img of a vzw dev edition aboot.mbn. This can be acquired using the dd command.

I was looking at some of the many long threads regarding attempts at unlocking the galaxy s4 as well as beaups' galaxy s5 developer edition hack, and I've come to think that what beaups did is to edit some unprotected small flag or string somewhere which is accessed by a developer ed. bootloader to check whether the phone matches the bootloader. He ran his program FIRST, then flashed what I suspect to be a signed dev edition bootloader which booted. If we can pick through the dev edition aboot.mbn with IDA pro and see where in memory the bootloader is checking to verify the phone, maybe we can copy his exploit.

If beaups had some kind of other exploit (to bypass security or other checks), there would be no reason for him to flash a new aboot.mbn, or even if so, he would have to edit some kind of string anyways to get the dev edition bl to work.

does anyone have any thoughts or feedback (or dev edition bootloaders)?

GeTex · Mar 23, 2016

I figure I can make this work but I need a bootloader dump.

karlsdroids · Mar 23, 2016

There's a guy who just posted about selling his dev edition, maybe he'd supply you with the dump??

Surge1223 · Mar 23, 2016

Hariiiii said:
Unfortunately, no. That only includes the kernel and ROM itself. What we need is an img of a vzw dev edition aboot.mbn. This can be acquired using the dd command.

I was looking at some of the many long threads regarding attempts at unlocking the galaxy s4 as well as beaups' galaxy s5 developer edition hack, and I've come to think that what beaups did is to edit some unprotected small flag or string somewhere which is accessed by a developer ed. bootloader to check whether the phone matches the bootloader. He ran his program FIRST, then flashed what I suspect to be a signed dev edition bootloader which booted. If we can pick through the dev edition aboot.mbn with IDA pro and see where in memory the bootloader is checking to verify the phone, maybe we can copy his exploit.

If beaups had some kind of other exploit (to bypass security or other checks), there would be no reason for him to flash a new aboot.mbn, or even if so, he would have to edit some kind of string anyways to get the dev edition bl to work.

does anyone have any thoughts or feedback (or dev edition bootloaders)?

When the mmc card is initialized in aboot, it loads /populates ddi_data and ddi_priv data. These contain info about the product generated from the Cid. It checks a value in qfprom and if a certain value makes it so sw_id or sw_revision isn't checked and/or is ignored. This also happens to correspond with a value of cc_type and determines if the device is a developer edition or not. I'm guessing @beaups has an exploit that writes over the mmc card Cid so the value returns from qfprom in such a way as to register as a developer edition device and this also allows the flashing of a dev edition boot chain. I'm guessing he had to flash the dev edition boot chain because the Cid hack probably wasn't going to remain permanently to whatver he wrote to it.

Maybe he'll chime in and tell me if I'm thinking on the right path/track. I'm not sure, I didn't study the function for very long, it was just something I noticed when I was going through the note 4 aboot.

beaups · Mar 23, 2016

Surge1223 said:
When the mmc card is initialized in aboot, it loads /populates ddi_data and ddi_priv data. These contain info about the product generated from the Cid. It checks a value in qfprom and if a certain value makes it so sw_id or sw_revision isn't checked and/or is ignored. This also happens to correspond with a value of cc_type and determines if the device is a developer edition or not. I'm guessing @beaups has an exploit that writes over the mmc card Cid so the value returns from qfprom in such a way as to register as a developer edition device and this also allows the flashing of a dev edition boot chain. I'm guessing he had to flash the dev edition boot chain because the Cid hack probably wasn't going to remain permanently to whatver he wrote to it.

Maybe he'll chime in and tell me if I'm thinking on the right path/track. I'm not sure, I didn't study the function for very long, it was just something I noticed when I was going through the note 4 aboot.

I'll reply for a change. I didn't do any research on aboot or the lock mechanism, @ryanbg did. There may be other "features", but his research indicated the eMMC cid was hashed, signed, and stored in the dev edition aboot for the device it was targeted for. So in order to flash (and more importantly boot) someone's "borrowed" dev-edition aboot, you need a cid that matches the signed hash. So, yes, I just changed the CID to match that. Then the flash is easy.

--beaups

GeTex · Mar 23, 2016

beaups said:
I'll reply for a change. I didn't do any research on aboot or the lock mechanism, @ryanbg did. There may be other "features", but his research indicated the eMMC cid was hashed, signed, and stored in the dev edition aboot for the device it was targeted for. So in order to flash (and more importantly boot) someone's "borrowed" dev-edition aboot, you need a cid that matches the signed hash. So, yes, I just changed the CID to match that. Then the flash is easy.

--beaups

So... This would in theory be possible then? If so, I have more digging to do. THANKYOU for the response. I'm getting a grip on this

Hariiiii · Mar 23, 2016

Holy **** I was right kind of. We need a dev edition aboot with its corresponding Cid NOW

beaups · Mar 23, 2016

Hariiiii said:
Holy **** I was right kind of. We need a dev edition aboot with its corresponding Cid NOW

You also need a way to change the CID.

Sent from my XT1254 using Tapatalk

Surge1223 · Mar 23, 2016

beaups said:
You also need a way to change the CID.

Sent from my XT1254 using Tapatalk

And therein lies the rub

beaups · Mar 23, 2016

Surge1223 said:
And therein lies the rub

Indeed

I plan to release details soon, I've been working on and off with documenting it. It won't be a "double click here to unlock", but the details will be sufficient for someone with coding/technical knowledge to turn it into a functioning tool (you seem to fit that description).

--beaups

Surge1223 · Mar 23, 2016

Hariiiii said:
Holy **** I was right kind of. We need a dev edition aboot with its corresponding Cid NOW

GeTex said:
So... This would in theory be possible then? If so, I have more digging to do. THANKYOU for the response. I'm getting a grip on this

I would suggest researching how/what the the CID does to effect these values though, fwiw, getting a dev edition aboot would be the least of your problems imho.

Hariiiii · Mar 23, 2016

@beaups
Yes....i quickly began to realize that this was the issue. I actually have no idea where the CID is on the galaxy s5, but based on reading some of ryanbg's posts, I'm going to guess it's in the rpmb partition at mmcblk0rpmb. This post in particular seems to be the important one:
http://xdaforums.com/showpost.php?p=52454292&postcount=18

I suppose the plan would be then to mount the partition as read/write, then scan through it with a hex editor, find the location of the CID in memory, and then maybe write over it using dd like in the link below? Or maybe I'm just crazy.

http://unix.stackexchange.com/questions/214820/patching-a-binary-with-dd

beaups · Mar 23, 2016

Hariiiii said:
@beaups
Yes....i quickly began to realize that this was the issue. I actually have no idea where the CID is on the galaxy s5, but based on reading some of ryanbg's posts, I'm going to guess it's in the rpmb partition at mmcblk0rpmb. This post in particular seems to be the important one:
http://xdaforums.com/showpost.php?p=52454292&postcount=18

I suppose the plan would be then to mount the partition as read/write, then scan through it with a hex editor, find the location of the CID in memory, and then maybe write over it using dd like in the link below? Or maybe I'm just crazy.

http://unix.stackexchange.com/questions/214820/patching-a-binary-with-dd

No, CID is in the eMMC hardware.

Hariiiii · Mar 23, 2016

beaups said:
You also need a way to change the CID.

Sent from my XT1254 using Tapatalk

beaups said:
No, CID is in the eMMC hardware.

Ok, so I found a file called CID in /sys/block/mmcblk0/device/

it has a number in it.....

it can't be that easy, can it? this is the number:

11010048313647453208872a30e41200

[GUIDE] Unlocking the Galaxys S5 Bootloader using DEV Bootloader [KK-MM]

Senior Member

Recognized Contributor

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Recognized Contributor

Senior Recognized Developer

Senior Member

Senior Member

Senior Recognized Developer

Recognized Contributor

Senior Recognized Developer

Recognized Contributor

Senior Member

Senior Recognized Developer

Senior Member

Similar threads

Top Liked Posts