Is Odin 3.14.4 Hacked?

[NR500r]

Unfortunately, I ended up using this version of Odin to try and flash some firmware on my S10+ and wanted to know what type of hack this is? Am I okay? A few forums on XDA developer said "This was posted on another thread and includes the file: cpprest141_2_10.dll

Caution #2 - There is a newer 3.14.4 version of odin floating about. It appears to be a hacked version 3.14.1 (same filesize); has internal modifications and includes a known cloud-based client-server communication dll (cpprest141_2_10.dll)! I would suggest that it be avoided."

Sure enough, I checked the folder and it contained the "cpprest141_2_10.dll" file!

 

[HIS YB]

So how does one know if it has hacked his phone after using because i just used one two days ago

 

[arunwa]

Most of the users use this version, I am not seeing Hacking cases, anybody mention after flashing.

 

[leshacat]

Most of the users use this version, I am not seeing Hacking cases, anybody mention after flashing.

Yeah someone is excessively paranoid its just a DLL file and its the only version of Odin there is (they ALL have this DLL file)

Just download and run it. If you get av warnings, then start pissing your pants but I would not think to hard over it. This DLL file is in literally every version 3.14.4 on Google so it likely is from Samsung or whoever makes Odin.

If I were to find other versions without it I would run those but there are no other versions on the internet without it - I searched google for hours.

 

[testestestest]

Yeah someone is excessively paranoid its just a DLL file and its the only version of Odin there is (they ALL have this DLL file)

Just download and run it. If you get av warnings, then start pissing your pants but I would not think to hard over it. This DLL file is in literally every version 3.14.4 on Google so it likely is from Samsung or whoever makes Odin.

If I were to find other versions without it I would run those but there are no other versions on the internet without it - I searched google for hours.

No, that file shouldn't be there I believe.

I found the "original" version at this site https://technastic.com/odin-download-samsung-latest-all-versions/ and they gives credit to someone from XDA. There is no "cpprest141_2_10.dll" file which is "A Microsoft project for cloud-based client-server communication in native code using a modern asynchronous C API design". Odin doesn't need such a thing at all - no way its needed there.

If you check the odin3.ini file you will see "Title" variable set to some site - for example from what I have seen so far "SAMTool.Org", "odin-samsung.com", "odindownloader.com" or "HardReset.info". All of these seems to be no good. The original seems to have only "odin" written there.

Always check the bottom left corner of the odin3 window. There is a link and almost every site loves to change it to their site or some malware site. If its anything else than "http://mobilerndhub.sec.samsung.net/hub/site/odin/" than its fake by my count.

 

[elruco]

hey, guys, there was a company trying to unlock my Samsung note 20 ultras with Verizon using team viewer, he downloads a program call Odin3 modded by OAKIEVILLE and also two files, so I put the phone in download mode he runs that program and my phone went into An error has occurred while updating the device software... and to me the phone got brick and he said that this phone cant b Done, and ill see u later....and refund my $100...now that I got into this site I've been reading and testing but I cant make it work....one file he left he was using on ODIN3 under tab AP the files ends on MSL.tar...dont know whats that and the other files ends on SpR.tar, any HELP or idea please
Thank you
This is what i get with ODIN
Added!!
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 4698 M
<ID:0/008> SetupConnection..
<ID:0/008> Initialzation..
<ID:0/008> Set PIT file..
<ID:0/008> DO NOT TURN OFF TARGET!!
<ID:0/008>
<ID:0/008> Re-Partition operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/008> Removed!!
<ID:0/008> Added!!
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 4698 M
<ID:0/008> SetupConnection..
<ID:0/008> Initialzation..
<ID:0/008> Set PIT file..
<ID:0/008> DO NOT TURN OFF TARGET!!
<ID:0/008>
<ID:0/008> Re-Partition operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 14094 M
<ID:0/008> SetupConnection..
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/008> Removed!!
<ID:0/008> Added!!
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 14094 M
<ID:0/008> SetupConnection..
<ID:0/008> Initialzation..
<ID:0/008> Set PIT file..
<ID:0/008> DO NOT TURN OFF TARGET!!
<ID:0/008>
<ID:0/008> Re-Partition operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

 

[CXZa]

No, that file shouldn't be there I believe.

I found the "original" version at this site

Yep, that dll is there for no reason. The Odin version 3.14.4 is just 3.14.1, resources changed a bit. That tech site just removed that dll and put the bogus version text and their url to the header bitmap.

Best part is this in version info:
"Modified by an unpaid evaluation copy of Resource Tuner 2"
(edit : also found some that don't have that...)

So, 3.14.4 is not hacked, just a boring hoax...

Easiest way (at the moment) to find out the true version is to check the version info of the SS_DL.dll. And even then compare it to others.

 

[droidzer1]

All those version seem to be fine with zero hits when loaded up to virustotal.com

 

[StoneyJSG]

hey, guys, there was a company trying to unlock my Samsung note 20 ultras with Verizon using team viewer, he downloads a program call Odin3 modded by OAKIEVILLE and also two files, so I put the phone in download mode he runs that program and my phone went into An error has occurred while updating the device software... and to me the phone got brick and he said that this phone cant b Done, and ill see u later....and refund my $100...now that I got into this site I've been reading and testing but I cant make it work....one file he left he was using on ODIN3 under tab AP the files ends on MSL.tar...dont know whats that and the other files ends on SpR.tar, any HELP or idea please
Thank you
This is what i get with ODIN
Added!!
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 4698 M
<ID:0/008> SetupConnection..
<ID:0/008> Initialzation..
<ID:0/008> Set PIT file..
<ID:0/008> DO NOT TURN OFF TARGET!!
<ID:0/008>
<ID:0/008> Re-Partition operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/008> Removed!!
<ID:0/008> Added!!
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 4698 M
<ID:0/008> SetupConnection..
<ID:0/008> Initialzation..
<ID:0/008> Set PIT file..
<ID:0/008> DO NOT TURN OFF TARGET!!
<ID:0/008>
<ID:0/008> Re-Partition operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 14094 M
<ID:0/008> SetupConnection..
<OSM> All threads completed. (succeed 0 / failed 1)
<ID:0/008> Removed!!
<ID:0/008> Added!!
<ID:0/008> Odin engine v(ID:3.1401)..
<ID:0/008> File analysis..
<ID:0/008> Total Binary size: 14094 M
<ID:0/008> SetupConnection..
<ID:0/008> Initialzation..
<ID:0/008> Set PIT file..
<ID:0/008> DO NOT TURN OFF TARGET!!
<ID:0/008>
<ID:0/008> Re-Partition operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

Were you trying to network unlock it or bootloader unlock it?

 

[Lumito]

I think Odin 3.14.4 is safe

I've downloaded Odin 3.14.4 from this website: https://odin-samsung.com/odin-3-14-4-odin-download-all-versions-for-samsung-flash.html

It clearly says in the description that this version may be a hacked release of Odin 3.14.1 and that they recommend using version 3.14.1, so they probably didn't modify it.

However, that DLL shouldn't be there. I DELETED it and disconnected from the internet, and the image (TWRP) flashed without issues.

Update: Tested with Wireshark and Task Manager and I haven't found anything wrong.

Update 2: https://app.any.run/tasks/4f543891-7af1-4698-83d4-044dafa522fd/

Update 3: Attached full version of Odin3 3.14.4 without the DLL.