[BOOTLOADER] Locked bootloader research and news [Updated: 7/16/2012]

[AdamLange]

Since locked Verizon SGS3 is now the main problem, i'v decided to split my kernel thread to separate one that focus directly on unlocking bootloader and progress in that matter.

Summary of the problem

Verizon model is protected from flashing unsigned/modified boot.img and recovery.img. Which means there is no known root method as for now for SCH-I535.
And that is where our adventure starts ....


Rooted stock boot.img issue:

<ID:0/008> Firmware update start..
<ID:0/008> boot.img
<ID:0/008> NAND Write Start!!
<ID:0/008> FAIL! (Auth)

CWM Recovery.img flash issue:

<ID:0/003> Firmware update start..
<ID:0/003> recovery.img
<ID:0/003> NAND Write Start!!
<ID:0/003>
<ID:0/003> Complete(Write) operation failed.

Research status: 50%
+ 20% - Some devs stated that RIL is hacked and there is also sucessfull Kexec implentation in works - http://xdaforums.com/showpost.php?p=28484191&postcount=262 Stay tuned for more news. Kexec proof-of-concept thread: http://xdaforums.com/showthread.php?t=1760678
+ 20% - phone can boot from unsigned boot.img flashed to recovery partition, this will leave you without recovery and requires to boot-trough-recovery every time u rebooting phone! (thanx invisiblek)
Links: http://xdaforums.com/showpost.php?p=28420589&postcount=47 , http://pastebin.com/eARk7r48

+ 10% - phone rooted trough system.img tricks -> http://xdaforums.com/showthread.php?t=1756885 (by invisiblek)


ROM analysys:
boot.img -> signed
recovery.img -> signed
system.img -> not signed
cache.img -> not signed

Update [7/7/2012]
News about locked Verizon model is spreading over the websites and main tech-related portals. Hopefully we will get some detailed info soon.

Update [7/7/2012]
It looks like it has been rooted by using system.img trick (system.img is not signed)
http://xdaforums.com/showthread.php?t=1756885
Enjoy! and thanx to invisiblek good job!

Update [07/15/2012] VZN insider confirmed this is not a true info
One of thread members chatted with verizon reps over mail & chat and got info that there may be possible unlocker released for bootloader at vzn locked phones. Here's the screenshots of chat: http://i.imgur.com/0lX3o.png , http://i.imgur.com/ULA4X.png
At this is not confirmed yet officialy, it may be interesting finding.

Update [07/15/2012]
Adam Outler posted he's own research info in separated thread, read it. It may help a bit -> http://xdaforums.com/showthread.php?t=1769411

Update [07/16/2012]
Galaxy S III Verizon Developer edition shows up on Samsung Website! -> http://www.samsung.com/us/mobile/cell-phones/SCH-I535MBCVZW


Thanks!

 

[AdamLange]

<reserved>

 

[AdamLange]

Help neede:

can anyone with rooted phone dump me partition scheme?

adb shell
command "mount"
copy paste at PM

As the ROM is not containing bootloader, we must dump it from phone

Adam

 

[invisiblek]

Help neede:

can anyone with rooted phone dump me partition scheme?

adb shell
command "mount"
copy paste at PM

As the ROM is not containing bootloader, we must dump it from phone

Adam

this should help you
http://pastebin.com/ruE9UCVi


EDIT: I'll dump anything you need, just PM me

 

[nosympathy]

this should help you
http://pastebin.com/ruE9UCVi


EDIT: I'll dump anything you need, just PM me

lol lists the year 1969? lol...

 

[Senryo]

lol lists the year 1969? lol...

45 minutes before Unix Time beings? What's the purpose of that I wonder?

When my phone arrives either today or Monday, I'm willing to supply any info as well!

 

[invisiblek]

I dumped all the partitions listed earlier. You can get them here.

I left out cache, system, userdata

I believe aboot is the bootloader...

These are dd images...

http://goo.im/devs/invisiblek/i535/dump.7z

 

[biff6789]

Now that we have root and can adb dump, can't we dump this guy's system and get his unique bootloader?

http://xdaforums.com/showthread.php?t=1754173

Worth a shot, no?

 

[Robster180]

Now that we have root and can adb dump, can't we dump this guy's system and get his unique bootloader?

http://xdaforums.com/showthread.php?t=1754173

Worth a shot, no?

I think that's what everyone is waiting for. He just hasn't posted in a little bit, i'm following like 5 threads dealing with his magic unlcoked custom boot screen.

 

[Pan Tralaliński]

that hopefully could be flahed over the one we have now. someone please contact him and ask to dump all his partitions and most important bootloader

 

[AdamLange]

I dumped all the partitions listed earlier. You can get them here.

I left out cache, system, userdata

I believe aboot is the bootloader...

These are dd images...

http://goo.im/devs/invisiblek/i535/dump.7z

Thanks for dump, looking into it ... its hard as this is blind shooting but heck that, someone need to do the dirty job ;P

 

[WildZontar]

This sucks. So this means alternate ROMs are out (I've seen phones like the Milestone get CM9 so I am confused)? Is the bootloader theoretically "crackable"?

I bought this phone with the expectation it would last well beyond Jelly Bean with the help of alternate ROMs. Really tiring of the expensive, environmental disaster that is planned obsolescence (a reason why I no longer use apple).

 

[NegativeOne]

Adam, I have great respect for what you've done for the community already, but I have a question. And I don't mean to hijack the thread.

There have been other devices with locked bootloaders, and nothing came of it. Do you see something special here that gives you hope of a resolution? I'm coming from a Droid X (I just stepped on the same landmine twice; next phone is HTC for sure.) and that one never got unlocked or broken either in over 2 years.

 

[AdamLange]

Im looking into bootloader code now, hopefully i will find something interesting. There is always hope but i will not promise or guarantee anything. I don't even own the device which is way more hardcore way to check if my findings will bring some results

I got some of interestd people in helping me out, but as i said, there is no promise from me.

 

[hitman_dreams]

NegativeOne, I too am coming from the X2 which never got an unlocked bootloader either. The only difference here is that millions of people are going to have this phone and will help with the unlocking of the bootloader. I'm sure we can get a leak from someone who also has this phone and wants it unlocked. I'm not sure if I can go through another locked bootloader phone like the X2 and might end up returning this Monday when it arrives in the mail. I can't even express how angry this is making me Verizon!

I'll hold on to it for a little while and see what kind of support it's getting in my two week return period. Keep up the good work AdamLange and invisiblek!

 

[invisiblek]

well, i've got here:

thats from flashing a custom boot.img using dd
i got the same thing yesterday flashing a kernel using cwm but, i didn't get the unlock icon by doing that

unlock icon sticks after reverting to the stock kernel using odin

 

[Robster180]

well, i've got here:

thats from flashing a custom boot.img using dd
i got the same thing yesterday flashing a kernel using cwm but, i didn't get the unlock icon by doing that

unlock icon sticks after reverting to the stock kernel using odin

For those of us that are a little slower to understand, could you expand on what that means for the bootloader? is it in fact encrypted? or no for sure yet's?

 

[juremy]

so...you're off to verizon store right?

 

[invisiblek]

so...you're off to verizon store right?

lol, funny guy

for the record, if anyone gets stuck at something like this, pull your battery and flash the stock version of whatever you were trying to flash (in this case the kernel) using odin

 

[stiltzkin]

Really appreciate you trying anyway dude. Huge fan of your work on the Inc, especially on kernels.

So essentially we can overwrite the boot.img, but it's still getting checksummed/verified somewhere by the system, right? Where is that check taking place, and is it feasible to modify/overwrite that portion of the system as well? Just throwing ideas out there, even though this seems like a very long shot.

Thanks again invisiblek.