[BOOTLOADER] Locked bootloader research and news [Updated: 7/16/2012]

Search This thread

AdamLange

Senior Member
Dec 9, 2003
1,319
2,576
Warsaw
samsung-updates.com
Since locked Verizon SGS3 is now the main problem, i'v decided to split my kernel thread to separate one that focus directly on unlocking bootloader and progress in that matter.

Summary of the problem

Verizon model is protected from flashing unsigned/modified boot.img and recovery.img. Which means there is no known root method as for now for SCH-I535.
And that is where our adventure starts ....


Rooted stock boot.img issue:
<ID:0/008> Firmware update start..
<ID:0/008> boot.img
<ID:0/008> NAND Write Start!!
<ID:0/008> FAIL! (Auth)

CWM Recovery.img flash issue:
<ID:0/003> Firmware update start..
<ID:0/003> recovery.img
<ID:0/003> NAND Write Start!!
<ID:0/003>
<ID:0/003> Complete(Write) operation failed.

Research status: 50%
+ 20% - Some devs stated that RIL is hacked and there is also sucessfull Kexec implentation in works - http://forum.xda-developers.com/showpost.php?p=28484191&postcount=262 Stay tuned for more news. Kexec proof-of-concept thread: http://forum.xda-developers.com/showthread.php?t=1760678
+ 20% - phone can boot from unsigned boot.img flashed to recovery partition, this will leave you without recovery and requires to boot-trough-recovery every time u rebooting phone! (thanx invisiblek)
Links: http://forum.xda-developers.com/showpost.php?p=28420589&postcount=47 , http://pastebin.com/eARk7r48

+ 10% - phone rooted trough system.img tricks -> http://forum.xda-developers.com/showthread.php?t=1756885 (by invisiblek)


ROM analysys:
boot.img -> signed
recovery.img -> signed
system.img -> not signed
cache.img -> not signed

Update [7/7/2012]
News about locked Verizon model is spreading over the websites and main tech-related portals. Hopefully we will get some detailed info soon.

Update [7/7/2012]
It looks like it has been rooted by using system.img trick (system.img is not signed)
http://forum.xda-developers.com/showthread.php?t=1756885
Enjoy! and thanx to invisiblek :) good job!

Update [07/15/2012] VZN insider confirmed this is not a true info
One of thread members chatted with verizon reps over mail & chat and got info that there may be possible unlocker released for bootloader at vzn locked phones. Here's the screenshots of chat: http://i.imgur.com/0lX3o.png , http://i.imgur.com/ULA4X.png
At this is not confirmed yet officialy, it may be interesting finding.

Update [07/15/2012]
Adam Outler posted he's own research info in separated thread, read it. It may help a bit -> http://forum.xda-developers.com/showthread.php?t=1769411

Update [07/16/2012]
Galaxy S III Verizon Developer edition shows up on Samsung Website! -> http://www.samsung.com/us/mobile/cell-phones/SCH-I535MBCVZW


Thanks!
 
Last edited:

invisiblek

Recognized Developer
Feb 24, 2010
1,584
5,895
Minnesota
www.invisiblek.org
Help neede:

can anyone with rooted phone dump me partition scheme?

adb shell
command "mount"
copy paste at PM

As the ROM is not containing bootloader, we must dump it from phone :)

Adam

this should help you
http://pastebin.com/ruE9UCVi


EDIT: I'll dump anything you need, just PM me
 
Last edited:

AdamLange

Senior Member
Dec 9, 2003
1,319
2,576
Warsaw
samsung-updates.com

WildZontar

Senior Member
Jul 11, 2010
105
185
Scranton, PA
This sucks. So this means alternate ROMs are out (I've seen phones like the Milestone get CM9 so I am confused)? Is the bootloader theoretically "crackable"?

I bought this phone with the expectation it would last well beyond Jelly Bean with the help of alternate ROMs. Really tiring of the expensive, environmental disaster that is planned obsolescence (a reason why I no longer use apple).
 
Last edited:

NegativeOne

Senior Member
Jul 21, 2010
997
159
Adam, I have great respect for what you've done for the community already, but I have a question. And I don't mean to hijack the thread.

There have been other devices with locked bootloaders, and nothing came of it. Do you see something special here that gives you hope of a resolution? I'm coming from a Droid X (I just stepped on the same landmine twice; next phone is HTC for sure.) and that one never got unlocked or broken either in over 2 years.
 

AdamLange

Senior Member
Dec 9, 2003
1,319
2,576
Warsaw
samsung-updates.com
Im looking into bootloader code now, hopefully i will find something interesting. There is always hope but i will not promise or guarantee anything. I don't even own the device which is way more hardcore way to check if my findings will bring some results :)

I got some of interestd people in helping me out, but as i said, there is no promise from me.
 

hitman_dreams

Senior Member
Aug 31, 2009
99
11
MA
NegativeOne, I too am coming from the X2 which never got an unlocked bootloader either. The only difference here is that millions of people are going to have this phone and will help with the unlocking of the bootloader. I'm sure we can get a leak from someone who also has this phone and wants it unlocked. I'm not sure if I can go through another locked bootloader phone like the X2 and might end up returning this Monday when it arrives in the mail. I can't even express how angry this is making me Verizon!

I'll hold on to it for a little while and see what kind of support it's getting in my two week return period. Keep up the good work AdamLange and invisiblek!
 

invisiblek

Recognized Developer
Feb 24, 2010
1,584
5,895
Minnesota
www.invisiblek.org
well, i've got here:

9EGNt.png


Ci0gY.png


thats from flashing a custom boot.img using dd
i got the same thing yesterday flashing a kernel using cwm but, i didn't get the unlock icon by doing that

unlock icon sticks after reverting to the stock kernel using odin
 

Robster180

Senior Member
Jul 4, 2012
81
5
well, i've got here:

thats from flashing a custom boot.img using dd
i got the same thing yesterday flashing a kernel using cwm but, i didn't get the unlock icon by doing that

unlock icon sticks after reverting to the stock kernel using odin

For those of us that are a little slower to understand, could you expand on what that means for the bootloader? is it in fact encrypted? or no for sure yet's?
 

stiltzkin

Senior Member
Dec 16, 2009
107
59

MKeRQ.jpg


Really appreciate you trying anyway dude. Huge fan of your work on the Inc, especially on kernels.

So essentially we can overwrite the boot.img, but it's still getting checksummed/verified somewhere by the system, right? Where is that check taking place, and is it feasible to modify/overwrite that portion of the system as well? Just throwing ideas out there, even though this seems like a very long shot.

Thanks again invisiblek.
 
Last edited:
  • Like
Reactions: Amazingbman

Top Liked Posts

  • There are no posts matching your filters.
  • 67
    Invisiblek succesfully booted to android using "adb reboot recovery" with his modified recovery.img.

    Basically we made it look as if going to recovery, but actually continuing onto boot.img.

    thats not 100% accurate

    i flashed a modified boot.img to our recovery partition (/dev/block/mmcblk0p18)
    then rebooted into recovery
    it booted up into android using this modified boot.img

    i don't plan for this to be of any real use to us though. proof of concept really

    we need our access to /dev/block/mmcblk0p7 (where our stock boot.img actually resided)

    thing is, we can flash to mmcblk0p7 just fine, but it wont boot (wont do anything actually other than let you get back into odin mode, where you can re-flash the stock boot image, or it gives you this when you try to boot android or recovery: http://i.imgur.com/Ci0gY.png )

    rest assured. this is being worked on...
    39
    Since this is a news thread...

    It was reported in IRC within the past hour or so that supposedly BOTH kexec is likely working and noobnl (whom many of you may know from his work with AOSP ROMs) has stated that the RIL has been cracked :D

    To those who don't know what that means, kexec chainloads kernels (in simplest terms, the custom kernel loads on top of the stock kernel AFTER the bootloader checks to make sure the stock kernel has been unmodified). This was necessary if one wanted to run a non-Touchwiz ROM (such as CM, AOKP, etc) or if they just wanted to run an overclocked, undervolted kernel.

    The RIL is essentially the radio. It was also needed to run a non-Touchwiz ROM and now opens the door to Jelly Bean ROMs.

    There is still working/testing to be done, and there are no ETAs, so don't bug the devs. They're actively working on it so let them do their thing.

    What a roller coaster of a weekend :)
    36
    Since locked Verizon SGS3 is now the main problem, i'v decided to split my kernel thread to separate one that focus directly on unlocking bootloader and progress in that matter.

    Summary of the problem

    Verizon model is protected from flashing unsigned/modified boot.img and recovery.img. Which means there is no known root method as for now for SCH-I535.
    And that is where our adventure starts ....


    Rooted stock boot.img issue:
    <ID:0/008> Firmware update start..
    <ID:0/008> boot.img
    <ID:0/008> NAND Write Start!!
    <ID:0/008> FAIL! (Auth)

    CWM Recovery.img flash issue:
    <ID:0/003> Firmware update start..
    <ID:0/003> recovery.img
    <ID:0/003> NAND Write Start!!
    <ID:0/003>
    <ID:0/003> Complete(Write) operation failed.

    Research status: 50%
    + 20% - Some devs stated that RIL is hacked and there is also sucessfull Kexec implentation in works - http://forum.xda-developers.com/showpost.php?p=28484191&postcount=262 Stay tuned for more news. Kexec proof-of-concept thread: http://forum.xda-developers.com/showthread.php?t=1760678
    + 20% - phone can boot from unsigned boot.img flashed to recovery partition, this will leave you without recovery and requires to boot-trough-recovery every time u rebooting phone! (thanx invisiblek)
    Links: http://forum.xda-developers.com/showpost.php?p=28420589&postcount=47 , http://pastebin.com/eARk7r48

    + 10% - phone rooted trough system.img tricks -> http://forum.xda-developers.com/showthread.php?t=1756885 (by invisiblek)


    ROM analysys:
    boot.img -> signed
    recovery.img -> signed
    system.img -> not signed
    cache.img -> not signed

    Update [7/7/2012]
    News about locked Verizon model is spreading over the websites and main tech-related portals. Hopefully we will get some detailed info soon.

    Update [7/7/2012]
    It looks like it has been rooted by using system.img trick (system.img is not signed)
    http://forum.xda-developers.com/showthread.php?t=1756885
    Enjoy! and thanx to invisiblek :) good job!

    Update [07/15/2012] VZN insider confirmed this is not a true info
    One of thread members chatted with verizon reps over mail & chat and got info that there may be possible unlocker released for bootloader at vzn locked phones. Here's the screenshots of chat: http://i.imgur.com/0lX3o.png , http://i.imgur.com/ULA4X.png
    At this is not confirmed yet officialy, it may be interesting finding.

    Update [07/15/2012]
    Adam Outler posted he's own research info in separated thread, read it. It may help a bit -> http://forum.xda-developers.com/showthread.php?t=1769411

    Update [07/16/2012]
    Galaxy S III Verizon Developer edition shows up on Samsung Website! -> http://www.samsung.com/us/mobile/cell-phones/SCH-I535MBCVZW


    Thanks!
    29
    Developing right now:

    JackpotClavin and Invisiblek have successfully loaded a custom kernel using a modified recovery ramdisk. It's still very early but this is excellent news for us. As it stands, this method wipes ClockworkMod and requires the recovery key combination on every boot, but those issues can probably both be overcome with custom scripts.

    Stay tuned guys...and mash those two guys' Thanks buttons!
    24
    hmmmmm kind of like your post was right?

    And your post also.

    On a good note while i was digging around last night through the source code I did notice something really nice about the SGSIII that should make you all very happy. As the guys at epic have noted, the kexec flag is marked, meaning that kexec can crash the existing kernel with one of its own. Now what does that mean you may ask. I'm glad you asked.

    For those of you that do not know there are 5 primary partitions that are contained on most phones and android devices:
    1. X-Loader
      This partition is usually the partition with the most basic hardware inits such as base gpio (buttons) and power toggles​
    2. bootloader
      This is the partition that contains what most of us as dev's hate the most, the dreaded boot signature, and boot instructions. When a bootloader is locked down it can be because of either a hardware lock, see OMAP4 processors Sec_On Pin, or a software lock, HTC's S-Off. When a bootloader is said to be locked, it can have two reasons for this, a signed header or an encryption algorithm on the entire partition.​
    3. recovery
      This partition is the one every one loves to see Clockwork Mod on. When not signed the partition can be flashed and used. ONE THING TO NOTE HERE IS THAT WHEN YOU USE THIS THREAD, YOU ARE SHOWING THAT THIS IS NOT SIGNED, Or the signature is not checked!!! This is intersting because it its self may show a security hole. The recovery might be what checks the CWM recovery flash images signature.​
    4. boot
      Perhaps one of the most interesting partitions on android devices. The boot partitions contains the binary for the kernel, and the inframs for the initilization of the os. This partition in this case has said to be signed, with a signature check in the bootloader that checks the validity of a boot partition, meaning there is no changing this.​
    5. system
      Contains most of the information on the OS. At this point all the framework and android settings get loaded. This partition is not signed, meaning we can modify to our will​
    6. userdata
      Contains the userdata, such as games and such​

    Now one thing to note is that there are two initialzation points, the first of which occurs in the boot parition and the second of which is in the system's /etc/init files. One thing that i would be interested in seeing is if you were to use this place to load in a new partition or an SD OS. for example:
    system1 partition init:
    Code:
    kexec -l /sdcard/kernel --reuse-cmdline --ramdisk=/sdcard/ramdisk
    system2 partition can then have an init that mounts a block partition from the sdcard onto the system partition.
    Code:
    mount /dev/block/mmc1... /system

    Now what does it all mean? This current method means that we can reload a compleatly new os onto a devices kernel and all. AKA Jelly Bean.

    For those dev which hope to find a way to make it work i point you to the following posts:

    2nd-init can be used for a second init after the first one to allow for kexec to be run (might not need this)

    kexec for ARM I might have to modify some kernel memory allocation issues but it should work none the less with the flag.