[Devs]Why are the new bootloaders so hard to exploit? - AT&T Samsung Galaxy S 5

A slightly technical question anyone?

Related

What are all the benefits of flashing ROMs?

I was looking in the All Tilt questions topic (so maybe I should move this question to there? ) and one poster seemed really hostile to another's question, because the other person was using AT&T's Tilt ROM instead of a cooked Kaiser ROM.
And he and a few other posters alluded to a few benefits of flashing (after all, that's why this site is here...right?)
But for AT&T Tilt users, what would the benefits of flashing be? I've already found out how to axe all of AT&T's bloatware, and I've gotten the HTC-specific programs I wanted (home screen with 6-way icons, KaiserTweak, etc.,), so I don't think those would be benefits of flashing for me.
Is the performance significantly different?
I guess, quite simply, what makes starting all over with a cooked ROM better than just improving the ROM you already have? This is probably an inherently n00bish question that is completely ignorant of the ROM-development process, so I shield myself from any flames

Dream roms on Mytouch?

I searched the forum and looked in the informative threads and didn't find an answer to my question. Basically, I have the G1 and my friend is getting the MyTouch. I have been hacking the G1 since I got it preorder so I know about this stuff. I will need to teach my friend how to do all that for his phone. But will the roms we have now work on the MyTouch? I know it is lacking a keyboard and has some slightly different specs. But I am assuming they will work on his after proper rooting and all. And does it root the same way or is it going to be something completely different?
thanks
JAWheat411 said:
I searched the forum and looked in the informative threads and didn't find an answer to my question. Basically, I have the G1 and my friend is getting the MyTouch. I have been hacking the G1 since I got it preorder so I know about this stuff. I will need to teach my friend how to do all that for his phone. But will the roms we have now work on the MyTouch? I know it is lacking a keyboard and has some slightly different specs. But I am assuming they will work on his after proper rooting and all. And does it root the same way or is it going to be something completely different?
thanks
Click to expand...
Click to collapse
myTouch can not be rooted at this point hence your friend is SOL. Check Sapphire threads

Questions Answered: Rogers Dream 1.89.631.1 (911 Update)

I thought I'd start this thread to answer a few questions regarding the 911 update put out by Rogers, as there is a lot of confusion in this section, and the development section may be too technical.
Q) Can I currently root my phone?
A) Yes, but not easily. It involves making some cables, buying a JTAG adapter, and doing a lot of stuff. Since it involves opening your phone, and attaching cables to the board, I'd advise those who do not feel confident doing this to avoid it.
Q) Why can't we root easily?
A) HTC really made it difficult in this update. Prior to the 911 update, there was a flaw in the linux kernel 2.6.27 that, when exploited, created a superuser session, allowing the user to flash whatever they wanted. Although the 911 update contained the same kernel, this exploit was patched. As of this moment, there are no other vulnerabilities that have been discovered.
As for the regular methods of flashing, HTC placed numerous checks throughout their firmware, preventing a user from installing any firmware that:
a) Is older than the current one
b) Is not built by HTC
c) Is not made for the specific model phone
Currently, the only way to bypass these security checks is via the JTAG model.
Any discussion of this firmware should stay in this thread. I'll try and answer any questions you may have.
I guess it would be good to know who is able to perform the JTAG.
Or is the only person EZterry?
XBrav said:
I thought I'd start this thread to answer a few questions regarding the 911 update put out by Rogers, as there is a lot of confusion in this section, and the development section may be too technical.
Q) Can I currently root my phone?
A) Yes, but not easily. It involves making some cables, buying MAKING a JTAG adapter, and (doing a lot of stuff)???. Since it involves opening your phone, and attaching cables to the board, I'd advise those who do not feel confident doing this to avoid it.
Q) Why can't we root easily?
A) HTC really made it difficult in this update. Prior to the 911 update, there was a flaw in the linux kernel 2.6.27 that, when exploited, created a superuser session, allowing the user to flash whatever they wanted. Although the 911 update contained the same kernel, this exploit was patched. As of this moment, there are no other vulnerabilities that have been discovered.
As for the regular methods of flashing, HTC placed numerous checks throughout their firmware, preventing a user from installing any firmware that:
a) Is older than the current one
b) Is not built by HTC
c) Is not made for the specific model phone
Currently, the only way to bypass these security checks is via the JTAG model.
Any discussion of this firmware should stay in this thread. I'll try and answer any questions you may have.
Click to expand...
Click to collapse
..........
Importspeed said:
I guess it would be good to know who is able to perform the JTAG.
Or is the only person EZterry?
Click to expand...
Click to collapse
The information is ALL in the jtag thread. No special trade secrets. Anyone who is not RETARDED can read, understand, and implement the entire process.
I've read the JTAG thread, I comprehend it, I don't have the tools to perform it and I would prefer someone with experience JTAGing to do it. It was just a simple question. No need to get all worked up about it buddy.
I believe ezterry is located in Toronto. If you're not confident doing the JTAG method and your located within a reasonable distance of him, contact him through PM and ask him if he can JTAG your phone for a fee.
I believe he charges around $35 and you also pay for shipping, presuming he has the time and is willing to do the JTAG for you. This method seams easiest to me and is cheaper than buying the JTAG hardware anyways, as long as you can go without your Dream for a while.
Yeah, I've contacted ezterry already. I'm pretty sure he is busy so I'd just like to see if there are other people that is able to perform this. I can live without the phone for awhile as I have a backup.
I guess I will just wait and hope ezterry will respond back to me and is willing to do this for me. I'm crossing my fingers.
Thanks for the help though.

What is an Encypted Bootloader and What does it Mean?

We seem to have a lot of confusion in the Atrix forum about the implications of an encrypted and or locked bootloader.
What is a bootloader?
See this article for a decent description.
Is the bootloader on the Atrix encrypted?
We don't know and likely will not know until the phone is released and people smarter than I can look at it. No reviews, including the Engadget review, have looked at whether the bootloader is encrypted. However, some have inaccurately said that it is because the installation of non-market apps is not permitted the bootloader is encrypted. However, this is a separate issue and is a requirement imposed by ATT that has nothing to do with the bootloader.
Why do people assume the bootloader is encypted?
Motorola has a strong recent history of releasing encrypted bootloaders, see the Droid X and Milestone phones. Most of the current discussion about the bootloader is limited to what we have seen from Motorola in the past. That being said, there is some hope that the bootloader will not be encrypted. In prior phones, such as the Droid X and Milestone, Motorola relied on the eFuse feature of Texas Instruments OMAP processors. Given that the Atrix uses an Nvidia Tegra 2 chip it is unlikely that Motorola can utilize the same eFuse technology.
As a result, there is some reason to be optimistic that the Atrix will only have a locked and not encrypted bootloader.
What is the difference between a locked and encrypted bootloader?
This is a good post on the topic. Locked bootloaders are on almost all android phones, including the Nexus S. Although certain locks, such as the Nexus S, are easier to open. A locked bootloader is essentially software that is written in such a way so as to prevent you from gaining access. So far XDA devs have been very skilled at cracking locked bootloaders by finding holes in this software.
An encrypted bootloader, from my understanding, is not itself encrypted, but signed by an encryption key. The phones hardware will refuse to boot unless the software that it attempts to boot is signed with the correct encryption key. The only options to crack this protection appear to be to go around the bootloader which is unlikely or to crack the encryption which also appears unlikely. See this post for more discussion.
What does an encypted bootloader mean to me?
This post at Android Forums provides a great summary of the effects of an encrypted bootloader. If you have the time, the entire thread is very informative.
The bad news is an encrypted bootloader likely means no custom kernels. This means that custom ROMs must rely on the official kernel. It also means the OS version (Froyo, Gingerbread . . .) is limited to whatever the official release is. The good news is that root access is still be possible. Root access allows you to run certain applications as the root or administrator. This allows for a lot of customization and hacking of your phone.
In the end, an encrypted bootloader may hinder your ability to completely hack the phone.
Can an encrypted bootloader be cracked?
Unlikely. For a brief discussion see this post and read the thread for a better understanding. I am aware that there is a team working on cracking the Milestone encryption using the BIONIC platform and a distributed computing effort, see androinc.net. However, even that team admits that the second coming of the dinosaurs may occur before they crack the encryption. I believe on the Milestone that the encryption is 1024 bit, which according to androinc.net may take hundreds of thousands of years to crack using a brute force method, even on a distributed computing platform.
Can a locked bootloader be cracked?
We won't know until we see it, but likely yes. Generally all software coded by humans has some error in it that can be exploited.
Why should I care if the bootloader protection cannot be circumvented?
You don't have to. But, in today's environment, consumers are tied to a 2 year contracts but new phones are released on a 1 year or less timeline. This means the device you buy today will likely be forgotten by your carrier and the phone manufacturer long before your contract is up. The inability to load custom kernels means that consumers cannot upgrade their own phones after the manufacturer decides to no longer support the phone. The decision to stop supporting upgrades often occurs well before a phones 2 year birthday, see the Motorola Upgrade Roadmap.
In addition, many people believe that they have purchased the phone hardware and should be permitted to do anything that they please with the hardware.
** I do not claim to be an expert, I have only recanted the results of my research. If I have made a mistake please let me know.
thanks for writing this i was going to my self today as i have been fighting people all day with this, i was trying to get motorola to tell me as i had a few reps available in a forum and one said that he will get back to me shortly with an answer ... but i was having to do so with people that dont know the difference chiming in and making the q&a with moto hard even for some one who does know what hes talking about ... any how i will update when i get my reply, and thanks again for putting info in right place btw up at top you put milestone instead of atrix
What a great and informative post. THIS SHOULD BE STICKIED for the time being to prevent future threads that ask the same questions. Great job.
Sent from my MSM using XDA App
sdlopez83 said:
What a great and informative post. THIS SHOULD BE STICKIED for the time being to prevent future threads that ask the same questions. Great job.
Sent from my MSM using XDA App
Click to expand...
Click to collapse
+1 here, very informative.
Thanks and sorry about the typos.
Nice job both in the layout and in maintaining an unbiased take on the possibilities.
thankyou for explaining that so well
can we get a MOD to sticky this for a while, at least until we know whether it is encrypted or what not. could really cut down on the "does the bootloader restrict me from doing xxxxxxxxxxx?" chatter on all the threads.
+1 Great post! Guess we'll have to wait for quantum computers before we can crack 1024bit encryption in under a lifetime (seconds probably.) But very informative, I'm off to read everything you linked in your post.
Excellent post sir!
Great post! This should be required reading...
That means that if the Atrix 4G is HSUPA disabled, there's no way around it?
royalemint said:
That means that if the Atrix 4G is HSUPA disabled, there's no way around it?
Click to expand...
Click to collapse
please post in the general forum where a thread is going about this. however, it can mostly likely be resolved with a new modem driver.
I have an Atrix 4G in my hand... how can I find out if the bootloader is encrypted?
EGBTMagus said:
I have an Atrix 4G in my hand... how can I find out if the bootloader is encrypted?
Click to expand...
Click to collapse
I would like to know also. I know there are other threads about this the only problem is that there are 6 different answers/opinions.
Does not look good:
The Atrix 4G has a locked and encrypted bootloader. More bootloader related announcements are forthcoming.
http://getsatisfaction.com/motorola...tm_medium=email&utm_source=reply_notification
TinyRK said:
Does not look good:
The Atrix 4G has a locked and encrypted bootloader. More bootloader related announcements are forthcoming.
Click to expand...
Click to collapse
... and here just for the record:
https://supportforums.motorola.com/thread/45249?start=15&tstart=0
meta96 said:
... and here just for the record:
https://supportforums.motorola.com/thread/45249?start=15&tstart=0
Click to expand...
Click to collapse
I saw both of those. I am not totally convinced by a PR response, even if it is from Moto. So far the devs here in XDA seem to think it is only signed. I am inclined to believe them more, at least until I see otherwise.
Also, I need to update my OP and will try and do so tonight.
krkeegan said:
I saw both of those. I am not totally convinced by a PR response, even if it is from Moto. So far the devs here in XDA seem to think it is only signed. I am inclined to believe them more, at least until I see otherwise.
https://supportforums.motorola.com/thread/45249?start=15&tstart=0
Also, I need to update my OP and will try and do so tonight.
Click to expand...
Click to collapse
... the number of page views for this topic is bad PR, isn't it? It is just a act/react thing, you know ...
Who is your daddy and what does he do?
I dunno why but that's immediately what I thought of, lol
Sent from my MB860 using XDA App

S-Off cans and can'ts

As we now have two s-off exploits and there appears to be a little confusion in the forum about what this actually gives to us, I think it would be a good time to produce a clear article regarding what we can and can't do now with our device and the difference between the two exploits. If nothing else, this may prevent many hard bricked devices.
.....Although I consider myself reasonably knowledgable, I am still one who is somewhat confused. Can I install any RUU? Can I install any firmware? Can I flash a h-boot? Will I still get ota updates........
I, and I am sure many others, would really appreciate it if somebody who really knows about these things could find the time to produce such an article for the masses here.
Hold your horses, bob. S-OFF preventing hard bricked devices? If anything S-OFF is the thing leading to hard bricked devices.
Theshawty said:
Hold your horses, bob. S-OFF preventing hard bricked devices? If anything S-OFF is the thing leading to hard bricked devices.
Click to expand...
Click to collapse
Perhaps I wasn't very clear. I meant that without clear understanding people with s-off may easily hard brick there devices hence the need for clear cans and can'ts, dos and don'ts so that people don't do anything silly (fatal).

Categories

Resources