Root for J7 Crown (S767VL)? Straight Talk/Tracfone/Total Wireless phone.

[Droidriven]

Then why is download mode still different? Why does it show FRP lock on and KG state prenormal?

If you mean, why does it not say "checking"?

If there is a combination firmware that has the same binary version as what you updated it with, try flashing that and then toggle the OEM unlock in the combination firmware then boot into download mode again and flash the firmware that you flashed.

Sent from my SM-S767VL using Tapatalk

 

[Deleted member 10802473]

If you mean, why does it not say "checking"?

If there is a combination firmware that has the same binary version as what you updated it with, try flashing that and then toggle the OEM unlock in the combination firmware then boot into download mode again and flash the firmware that you flashed.

Sent from my SM-S767VL using Tapatalk

Ok I'll look for a combo firmware with the same bootloader version

Edit: I can't find anything all the combo files are old
There has to be something because that phone is somehow modified.

 

[ZafotheNinja]

Can you give my detailed photos of every part of the motherboard that has some kind of model or serial number printed on it? Not the Samsung model number. It is no surprise that it is a rebrand 737. That information might even come in handy, the things that have been developed for the 737 "should" be able to be used on the 767 because the chipset hasn't change, it's pretty much only the bootloader and binary versions that we are trying to get around. If they can be bypassed, anything for 737 "should" work.

Anyway, the point is, if I can identify the board itself, I might be able to find schematics. It would not surprise me if that same board has been contracted/used by other manufacturers in other devices with some rearrangement/redesign of the components to fit other case designs and orientation of hardware buttons or external connectors/ports/jacks.

Sent from my SM-S767VL using Tapatalk

OH! You said Every part of the motherboard *That had a Model Number*, I just read every part which I thought meant every chip number... Well shoot, now what do I do with this? (Also got those model numbers in the same folder)

https://mega.nz/folder/LEcAAIbA#z4PviMfArvRpNwGCKF74xw

Oh, and I doubt the needle size on that syringe is .2mm, I think y'all where seeing .2ml which is how much paste, not needle size. Anyway, the dip method droid described should work fine whatever tip size it is.

 

[Droidriven]

OH! You said Every part of the motherboard *That had a Model Number*, I just read every part which I thought meant every chip number... Well shoot, now what do I do with this? (Also got those model numbers in the same folder)

https://mega.nz/folder/LEcAAIbA#z4PviMfArvRpNwGCKF74xw

Oh, and I doubt the needle size on that syringe is .2mm, I think y'all where seeing .2ml which is how much paste, not needle size. Anyway, the dip method droid described should work fine whatever tip size it is.

Yes, I saw that discrepancy, but the tip still looks like it "might" work.

Sent from my SM-S767VL using Tapatalk

 

[retred829]

Bought (unknowingly) a locked Galaxy J7 Crown Model SM-S767VL; Hardware S767VL.04 from Quality One Wireless in Orlando, FL (to use on PagePlusCellular; Verizon Vte/CDMA). PPC said they unlocked but lied. QOW says: "...unlocked or not it is only compatible with Tracfone/Page Plus service. The IMEI of the device is not in Verizon’s ODI database." I don't understand what they are talking about? Someone please explain...(I was using Verizon services w/ PPC....)

 

[ZafotheNinja]

Bought (unknowingly) a locked Galaxy J7 Crown Model SM-S767VL; Hardware S767VL.04 from Quality One Wireless in Orlando, FL (to use on PagePlusCellular; Verizon Vte/CDMA). PPC said they unlocked but lied. QOW says: "...unlocked or not it is only compatible with Tracfone/Page Plus service. The IMEI of the device is not in Verizon’s ODI database." I don't understand what they are talking about? Someone please explain...(I was using Verizon services w/ PPC....)

Generally these phones are locked to prepaid, so you are looking at Straight talk or Tracfone service and it is possible to "Rebrand" one to the other. These Carriers have a deal with the larger carriers to use their towers for service. Your phone, being a VL model, runs on the Verizon towers and should have similar coverage. I have not heard of PPC, I dont know if their service would work with this phone. If you can buy the same model on their website and have a clean esn then your phone should work fine.

 

[retred829]

Generally these phones are locked to prepaid, so you are looking at Straight talk or Tracfone service and it is possible to "Rebrand" one to the other. These Carriers have a deal with the larger carriers to use their towers for service. Your phone, being a VL model, runs on the Verizon towers and should have similar coverage. I have not heard of PPC, I dont know if their service would work with this phone. If you can buy the same model on their website then it should work fine.

I was 'forced' to upgrade to this phone by PPC & Straighttalk: They refused to service my 1-yr.-older Samsung model. PPC provided Verizon coverage for 13 mos. Now I want to (continue) use(-ing Verizon service on) Red Pocket Mobile's SIM (on Verizon) but my (Samsung) PPC seller says that "The IMEI of the device is not in Verizon.s ODI database"....whatever that means (?) The seller locked the IMEI somehow to TracFone only. Red Pocket Mobile is not a TracFone ally but does provide Verizon CDMA service in my area (?) So the phone is 'unlocked' to use with multiple Tracfone mercenaries but NOT UNLOCKED to use providers outside of their gang/club/franchise/mob/fraternity/cancel culture... Thus: I'm trying to find a 'Trump' outside the 'Tracfone swamp'. Are there any?

 

[ZafotheNinja]

I was 'forced' to upgrade to this phone by PPC & Straighttalk: They refused to service my 1-yr.-older Samsung model. PPC provided Verizon coverage for 13 mos. Now I want to (continue) use(-ing Verizon service on) Red Pocket Mobile's SIM (on Verizon) but my (Samsung) PPC seller says that "The IMEI of the device is not in Verizon.s ODI database"....whatever that means (?) The seller locked the IMEI somehow to TracFone only. Red Pocket Mobile is not a TracFone ally but does provide Verizon CDMA service in my area (?) So the phone is 'unlocked' to use with multiple Tracfone mercenaries but NOT UNLOCKED to use providers outside of their gang/club/franchise/mob/fraternity/cancel culture... Thus: I'm trying to find a 'Trump' outside the 'Tracfone swamp'. Are there any?

To my knowledge no, but someone more experienced might know better. Currently we are stuck on stock roms with no root, you could try your luck with the hardware unlock chips you put between your phone and the sim and/or activate your sim and plop it in to see what it does.

 

[Droidriven]

I was 'forced' to upgrade to this phone by PPC & Straighttalk: They refused to service my 1-yr.-older Samsung model. PPC provided Verizon coverage for 13 mos. Now I want to (continue) use(-ing Verizon service on) Red Pocket Mobile's SIM (on Verizon) but my (Samsung) PPC seller says that "The IMEI of the device is not in Verizon.s ODI database"....whatever that means (?) The seller locked the IMEI somehow to TracFone only. Red Pocket Mobile is not a TracFone ally but does provide Verizon CDMA service in my area (?) So the phone is 'unlocked' to use with multiple Tracfone mercenaries but NOT UNLOCKED to use providers outside of their gang/club/franchise/mob/fraternity/cancel culture... Thus: I'm trying to find a 'Trump' outside the 'Tracfone swamp'. Are there any?

Tracfone is known for locking their devices to the Tracfone network variants. Yes, exactly, it is "unlocked" as far as the Tracfone network variants and potentially Verizon pre-paid are concerned, but not other networks. I've seen other Tracfone devices activated on the Verizon network with no issue, they just put the SIM in then go to their Verizon account on the Verizon website and enter the device and SIM info to add it to their account.

Sent from my SM-S767VL using Tapatalk

 

[ZafotheNinja]

I had to update because I tried to flash the Magisk patched AP file because I thought that maybe it was unlocked but it failed so then I flashed stock Android 9.0. I guess I could of flashed Android 8.1 stock but I didn't feel like waiting 2 hours for it to download.

How goes the JTAG?

 

[Deleted member 10802473]

How goes the JTAG?

I got the glue but am still waiting for a magnifying glass
Also the tip of the glue looks like it should work. The hard part is going to be not letting the glue touch because the pins are really close together.

 

[Droidriven]

I got the glue but am still waiting for a magnifying glass [emoji14]

Also the tip of the glue looks like it should work. The hard part is going to be not letting the glue touch because the pins are really close together.

Squeeze the plunger on the glue until a small droplet of glue comes to the tip of the applicator, then, touch the tip of your stripped wire end to the droplet of glue to apply a small amount to the tip of the wire, then touch the tip of the wire to the contact and hold it there using a needle or the tip of a razor blade or anything else very thin until the glue hardens enough to let go.

I suggest you use pieces of wire 3-4 inches long to connect to the pads, then, when you are ready to test, you can connect the JTAG wires to the wires that you glued to the pads, that way, if the connections aren't right, you can just switch them around easier than if you glue the JTAG wires to directly to the pads.

Sent from my SM-S767VL using Tapatalk

 

[ZafotheNinja]

Score! I just bought a j7 on ebay that was listed as "Modded", they didn't have any more information than that but it is definitely not running stock fw. Is this engineering fw, or a "Factory Binary" as it likes to call its self? Anyway, Its really cool and has an April 1st security patch (no joke, its actually April 1st lol). OEM unlocking was on when I turned it on, as well as USB Debugging. Couldn't get into download mode, but recovery mode and upload mode I can, maybe just wrong key combo.

Pics: https://mega.nz/folder/mJ9HVRbR#5UZb_1NUuwqR6qtEDgfkeg

I'ma start researching if any of these security exploits have poc's I can use, as it currently stands it is not rooted as far as I can tell. Maybe one of the root tools will work with this?

 

[Droidriven]

Score! I just bought a j7 on ebay that was listed as "Modded", they didn't have any more information than that but it is definitely not running stock fw. Is this engineering fw, or a "Factory Binary" as it likes to call its self? Anyway, Its really cool and has an April 1st security patch (no joke, its actually April 1st lol). OEM unlocking was on when I turned it on, as well as USB Debugging. Couldn't get into download mode, but recovery mode and upload mode I can, maybe just wrong key combo.



Pics: https://mega.nz/folder/mJ9HVRbR#5UZb_1NUuwqR6qtEDgfkeg



I'ma start researching if any of these security exploits have poc's I can use, as it currently stands it is not rooted as far as I can tell. Maybe one of the root tools will work with this?

Yes, that is the factory engineering firmware, I've already tried flashing that to toggle the OEM unlock, this does result in RMM/KG changing to "checking". From there, tried flashing TWRP ported from another J7 variant with the same hardware, the flash did not even attempt to work, always resulted in a fail in Odin, even when using Cosmys Odin and modified Odin. Even tried patching .img files using Magisk then flashing those, no success, it would give a "PASS", but it would give a SW Rev fail when the device tried to boot and then went into a panic mode. Then I had to boot into download mode using a special combination and release of the buttons at just the right moment then flash back to the stock firmware. No matter what approach I tried when patching, mixing, porting, flashing, nothing worked.

If you go back a few pages in this thread, you will see an entire discussion of the whole process when we were trying to get it to work. When I said that tried everything, that literally meant "everything", as in, everything. The only option I haven't tried is to get access to a eng root .img then flashing that but good luck finding one. You would have to pay a shady website to get it and then it would have no guarantee to work.

What I think you have is a device that someone tried a FRP removal trick on but didnt know what they were doing and couldn't get it straightened out so they sold it.
Sent from my SM-S767VL using Tapatalk

 

[ZafotheNinja]

Yes, that is the factory engineering firmware, I've already tried flashing that to toggle the OEM unlock, this does result in RMM/KG changing to "checking". From there, tried flashing TWRP ported from another J7 variant with the same hardware, the flash did not even attempt to work, always resulted in a fail in Odin, even when using Cosmys Odin and modified Odin. Even tried patching .img files using Magisk then flashing those, no success, it would give a "PASS", but it would give a SW Rev fail when the device tried to boot and then went into a panic mode. Then I had to boot into download mode using a special combination and release of the buttons at just the right moment then flash back to the stock firmware. No matter what approach I tried when patching, mixing, porting, flashing, nothing worked.

If you go back a few pages in this thread, you will see an entire discussion of the whole process when we were trying to get it to work. When I said that tried everything, that literally meant "everything", as in, everything. The only option I haven't tried is to get access to a eng root .img then flashing that but good luck finding one. You would have to pay a shady website to get it and then it would have no guarantee to work.

What I think you have is a device that someone tried a FRP removal trick on but didnt know what they were doing and couldn't get it straightened out so they sold it.
Sent from my SM-S767VL using Tapatalk

Can you tell if this is the same version as the one you tried?

 

[Droidriven]

Can you tell if this is the same version as the one you tried?

Yes, I already confirmed that, as I said, go back and read the discussion some pages back in this thread, you will see everything discussed down to specific build numbers. Come now, be thorough before asking questions, go back and read so that I don't have to repeat things that are already posted in this thread.

Sent from my SM-S767VL using Tapatalk

 

[Deleted member 10802473]

Squeeze the plunger on the glue until a small droplet of glue comes to the tip of the applicator, then, touch the tip of your stripped wire end to the droplet of glue to apply a small amount to the tip of the wire, then touch the tip of the wire to the contact and hold it there using a needle or the tip of a razor blade or anything else very thin until the glue hardens enough to let go.

I suggest you use pieces of wire 3-4 inches long to connect to the pads, then, when you are ready to test, you can connect the JTAG wires to the wires that you glued to the pads, that way, if the connections aren't right, you can just switch them around easier than if you glue the JTAG wires to directly to the pads.

Sent from my SM-S767VL using Tapatalk

Thanks! Although I am STILL waiting for a magnifying glass

 

[Droidriven]

Thanks! Although I am STILL waiting for a magnifying class

Set up a well lit, dust-free work area. If you have another phone that has a large screen or a tablet, find something that can be used to position the phone or tablet a comfortable distance above the work area without interfering with lighting. Then use the rear facing camera on the phone or tablet to zoom in on the workspace. It's a trick I often use to magnify tiny things to more easily see them.

Sent from my SM-S767VL using Tapatalk

 

[Deleted member 10802473]

Set up a well lit, dust-free work area. If you have another phone that has a large screen or a tablet, find something that can be used to position the phone or tablet a comfortable distance above the work area without interfering with lighting. Then use the rear facing camera on the phone or tablet to zoom in on the workspace. It's a trick I often use to magnify tiny things to more easily see them.

Sent from my SM-S767VL using Tapatalk

Again, Thanks for your help! I will try it tomorrow
Hopefully we can get this thing rooted!

 

[Droidriven]

Again, Thanks for your help! I will try it tomorrow
Hopefully we can get this thing rooted!

Obviously, it will require quite a good camera, otherwise, when you zoom in, you will lose resolution/clarity.

You would be surprised what this trick can reveal when viewing old physical photos, depending on the quality of the photo and the materials used to capture/develop/print.