Achiving Root on S10 g973u - Samsung Galaxy S10 Questions & Answers

I am tooling an exploit that can provide temp root
The exploit previously worked on the pixel 1 and 2, but was then again found in the pixel 3 which has a snapdragon core as well. It gave a temp root. I do believe it can be done for the US variant snapdragon as well. If it can I can do it we can achieve su read and write perms giving us another shot at unlocking the boot loader. What i am missing is the offsets for the files required to achieve the exploit goal. If anyone can help with those it would be very helpful

First off, the U.S. S10 has already been rooted and bootloader unlocked. It just costs $150 to do it. Read here:
https://www.xda-developers.com/samsung-galaxy-note-20-ultra-root-us-unlocked-snapdragon-865/
Next, if you can provide a free root method then by all means go for it, everyone here will love you.

StoneyJSG said:
First off, the U.S. S10 has already been rooted and bootloader unlocked. It just costs $150 to do it. Read here:
https://www.xda-developers.com/samsung-galaxy-note-20-ultra-root-us-unlocked-snapdragon-865/
Next, if you can provide a free root method then by all means go for it, everyone here will love you.
Click to expand...
Click to collapse
So I was confused by this
So there is no root for the S10 Snapdragon? There is a guide on the guide section but I can't activate oem unlock

There is root for the S10 snapdragon, it's the same method to root the S20 as stated in the article I linked above, only it costs $150. A free method would be better, but as of late nothing has surfaced. Hope this clears things up for you.

It will come with time, until then I am not doing any updates

The U.S. S10 costs (I think) $100 to bootloader unlock so it can be rooted. You just have to let some guy in China have access to ya phone.

Related

A71 SM-A715F/DS and A-716U questions

is the unlocked A-716U rootable using magisk and does anyone think there will be development on it(ie Custom recoveries ? One last question one this specific model; assuming root is possible on unlocked would it be possible to get a carrier locked version (cost saving) and reflash firmware similar to oneplus's MSMtool?
lastly is the A71 SM-A715F/DS root-able with TWRP support?
Thank you
ps
I will also contribute to bounties
everyone is going to say/think "search the forum!!!" but unfortunately the posts available dont list specific model numbers when talking about successful root/custom recovery,.
U.S. variants usually can't be unlocked and therefore you can't install custom stuff like magisk patched files.
That used to be the case until recently that a person was offering bootloader unlock as a service to many 2019 and onward devices, as you can see here: https://forum.xda-developers.com/t/sampwnd-usa-model-bl-unlock-info-u-u1-w.4201689/
But, you would have to ask if the A71 is supported. It probably would need to be tested, but the owner of the thread was quite confident that it could be possible.
ShaDisNX255 said:
U.S. variants usually can't be unlocked and therefore you can't install custom stuff like magisk patched files.
That used to be the case until recently that a person was offering bootloader unlock as a service to many 2019 and onward devices, as you can see here: https://forum.xda-developers.com/t/sampwnd-usa-model-bl-unlock-info-u-u1-w.4201689/
But, you would have to ask if the A71 is supported. It probably would need to be tested, but the owner of the thread was quite confident that it could be possible.
Click to expand...
Click to collapse
Oh okay, so there is no MSMtool like with oneplus devices where you can just change to international firmware? If so if there an international 5g version of the a71 (any a-series) with 5G? sorry the model/SKU's for samsung devices is confusing and there is an insane amount of them.
sixisixsix said:
Oh okay, so there is no MSMtool like with oneplus devices where you can just change to international firmware? If so if there an international 5g version of the a71 (any a-series) with 5G? sorry the model/SKU's for samsung devices is confusing and there is an insane amount of them.
Click to expand...
Click to collapse
I'm sort of guessing that's the Odin equivalent of Samsung devices, not sure I've never owned a OnePlus device.
You can use Odin to flash different firmware on the device as long as it's the same SoC. For example, I've flashed Galaxy S9+ Unlocked firmware on my T-Mobile Galaxy S9+. One is variant SM-G965U and the other is SM-G965U1. However on this case, both firmware were US. One was unbranded U.S. firmware and the other was T-mobile branded firmware. I've also flashed Poland firmware on my Mexican A71, they're both model SM-A715F on this case.
I don't know if there's an international variant of the A71 5G. I guess you'll have to look that part up on your own. I think there is though.
The MSM tool enable users to take a carrier locked oneplus device and unlock it among other things. can odin unlock bootloaders ?
sixisixsix said:
The MSM tool enable users to take a carrier locked oneplus device and unlock it among other things. can odin unlock bootloaders ?
Click to expand...
Click to collapse
Not really. Odin can only flash firmware, either stock or custom (you use it to flash TWRP and then basically everything else you flash with TWRP).
And no, Odin doesn't do any bootloader unlocking, any unlocking is done with the device itself. But as I mentioned, U.S devices aren't unlockable out the box.
ShaDisNX255 said:
Not really. Odin can only flash firmware, either stock or custom (you use it to flash TWRP and then basically everything else you flash with TWRP).
And no, Odin doesn't do any bootloader unlocking, any unlocking is done with the device itself. But as I mentioned, U.S devices aren't unlockable out the box.
Click to expand...
Click to collapse
when you say "out of the box" do you mean there is NO possible way to unlock them or it takes a process?
sixisixsix said:
when you say "out of the box" do you mean there is NO possible way to unlock them or it takes a process?
Click to expand...
Click to collapse
There is no possible way to do it... for free as of now. If you want to unlock the U.S. variant you have to do it via the paid service I pointed out and thats only IF it works (as I mentioned, its been untested on the A71)
In comparison, you can buy the F variant, turn it on, head to developer settings and select OEM unlock and then unlock the bootloader.
If we ignore the paid service, sampwnd, that I pointed out in my other response then it is impossible to unlock the bootloader of the US variant and therefore, impossible to root.
ShaDisNX255 said:
There is no possible way to do it... for free as of now. If you want to unlock the U.S. variant you have to do it via the paid service I pointed out and thats only IF it works (as I mentioned, its been untested on the A71)
In comparison, you can buy the F variant, turn it on, head to developer settings and select OEM unlock and then unlock the bootloader.
If we ignore the paid service, sampwnd, that I pointed out in my other response then it is impossible to unlock the bootloader of the US variant and therefore, impossible to root.
Click to expand...
Click to collapse
how much does the paid service cost and do you have a link? i didnt see you mention it before. also do you have the aseries discord invite or telegram?
sixisixsix said:
how much does the paid service cost and do you have a link? i didnt see you mention it before. also do you have the aseries discord invite or telegram?
Click to expand...
Click to collapse
I'm not really sure about the cost as I've never used the service myself, but I know the person running the thread is very reliable
Link: https://forum.xda-developers.com/t/sampwnd-usa-model-bl-unlock-info-u-u1-w.4201689/
There are a few A71 groups on Telegram, you can just search with @A71 on there, most groups are public

Question Bootloader Unlock & Rooting help please.

I just got my phone, the Samsung Galaxy S21 Ultra 5G SM-998U How do I Unlock the bootloader, root & install Msgisk, and customize my kernel? I have the Snapdragon version if that helps any.
- Thanks.
[Magisk][US/CAN BL Unlock] Root for Galaxy S21 Series (B/N/0/U/U1/W)
Note: this guide copied from topjohnwu's. Original guide here US/Canada bootloader unlock thread: here Before Installing Magisk Installing Magisk WILL trip KNOX Unlocking bootloader for the first time will do a data wipe. Installation If you...
forum.xda-developers.com
There is a search function. Make sure you understand what tripping Knox does as you cannot undo it. And remember Magisk Hide has been discontinued by the dev so most apps will be able to detect the phone is rooted again.
Why didn't you research this before you aquired your device? It's not likely your phone is eligible as unlocking the BL requires you haven't updated it. Additionally you'll trip knox and lose a number of features, to include ongoing updates. If you wanted a device you could root and desired a Snapdragon variant those are available without paying for that service. So based on all the features you'll forfeit what advantages outweigh this? Those should be substantial to justify all the down sides you'll incur.
Thank you for your reply. What phone would you suggest is best for customizing and closing roms?l
Mrworley831 said:
Thank you for your reply. What phone would you suggest is best for customizing and closing roms?l
Click to expand...
Click to collapse
OnePlus seems to be the concensus choice.
Redirect Notice
If you want an S21 the Global Exynos variant has an Unlocked BL plus the best selection for Custom ROM's. The SM-G9980 Snapdragon variant has an Unlocked BL as well. If you chose the S21 all the issues I mentioned are still in play, the only difference is you don't have to pay to unlock it.

Newbie question - unlocking / rooting the S20 FE

Hello all,
I have a newbie question - please be patient and point me in the right direction. (And yes I did use Google first).
The question is about rooting the (Canadian) S20 FE 5G.
I understand there are different ways to root - and all require unlocking.
For unlocking there are two sets of instructions
- one instruction says I go into developer settings, select unlock and all is good
- the other instructions advise that one has to pay to have this unlocked (to some guy on Telegram) and the price is pretty expensive.
So which one is it?
I am considering the S20 FE and rooting would be one of the first things -so I would like to know if that comes at an extra cost or not.
Thank you for any pointers!
if you have a Canadian FE and it's firmware is earlier than March (as I understand things) you can ONLY pay via the man on telegram to get it unlocked. if your firmware is after March even that might not work for you.
all Qualcomm phones sold in the US and Canada can't be unlocked via simply toggling OEM unlocking in developer options.
As 3mel said "... all Qualcomm phones sold in the US and Canada can't be unlocked via simply toggling OEM unlocking in developer options"
too many folks just don't get that !!!
As far as paying > some person online- True But ... at this time, there are a few that say they do the S20 FE 5G cheap too. Either via Email or Their App.
All I Do Know, is IF you do this, You will not get any OEM updates, (Seeing how they (samsung) that the S20 FE 5G will see 3 major updates at least, came with 10, we are on 11, and so 12 is coming)
Yes, I see you may not wat to have read that, but, with the Carrier unlocked, and Root, am sure in a short time, we can see many different roms for these Newer Phones...
if you remove root and any custom recovery (usually by just flashing stock over everything) you will start receive OTA updates again.
that's even if the bootloader is still unlocked!!
I doubted this at first but it worked for me. plus updating and reapplying root isn't that hard once you've got a decent idea about what each step is doing and why it needs to be done.

SM-G973u1 snapdragon root

Sorry to just drop a question, but I can't find the answer. Can the snapdragon S10 SM-G973u1 bootloader be unlocked? If not is there another way to root it?
Thank you
Chris
​
HelloChris333333, just when you post on a forum the courtesy of saying hello. Yes you can root just with the firmware of your model S10 SM-G973U1 US model so not compatible with EU firmware.
meric57 said:
HelloChris333333, just when you post on a forum the courtesy of saying hello. Yes you can root just with the firmware of your model S10 SM-G973U1 US model so not compatible with EU firmware.
Click to expand...
Click to collapse
I'm not sure that's true, but I would love to find out I'm wrong.
In my research, the SD phones cannot be unlocked unless you are on (and remain on) an older BL version. The last unlockable BL version was 4, as I recall... if you're running updated firmware you are likely on BL 6. Even on 4, the process was not free and once you did it you could not update to a newer version of FW without losing the unlock.
For this reason, I gave up on getting root/BLunlock on my phone... and honestly, I have not missed it. This is also why I have not seen much development of FW for the SD phones anywhere.
Again, if I'm wrong, I'd love to learn how it's done!
Hello meric57
Can you share a link to the firmware I need? I just bought this phone and there is no OEM unlock option, it is a US phone. If I cannot root it I will have to sell it and get another phone.
Thanks
Chris
I guess another question would be where can I get a S10 with the Exynos chip?
Thanks
Chris
Using ADB I keep getting "waiting for device" and then I find I need to unlock the bootloader. This crap is an endless circle.
U4 can be unlocked before , I can unlock it , Special engineering documents need to be made
I'm V6 nothing available. I bought a G973F instead. G973u1 going on ebay.
Exactly, there is really no root/unlock for snapdragon phones unless you're on a very old BL (and you have to stay there so you can't update). IMO, that's not "can be unlocked" even with "special" steps, particularly since most phones today will have newer BLs (even a year ago, I couldn't find a BL4 phone)... but, yes, it's technically true to say it can be unlocked, but only in very limited cases.
@Chris33333 For this reason, I get that you may want to go to the Exynos instead... I'm curious, if you're in the US, how does that work with carriers? Does it? I've found most US carriers refuse to activate phones that don't match their list of "compatible" IMEIs... I imagine an F-series phone won't be on that list.
I'm in the US using Straight Talk with T-mobile. I've had a Galaxy S5 rooted for years. With straight talk I can use AT&T, T-mobile, or Verizon. But this international phone does not do Verizon.
And StraightTalk will activate the F-series phone without complaint or issues? If so, that's great to hear... because I know VZ and ATT typically won't...
I haven't put the SIM in it yet. Still trying to delete all the crap off the phone.
Lol
Hello Chris33333, https://www.sammobile.com/samsung/galaxy-s10/firmware/SM-G973U1/XAA/

Any difference between g8441 and docomo japanese version?

Heya, after switching out yesterday from my first xz1 compact after 3 years to my 2nd one, i'd like to buy spare one, and i'd like to buy a cheap docomo one but will it work in france for the 4g/3g bands please?
is there anything i should be aware of please compared to the g8441 please?
There is a difference in coverage of frequency bands between them. According to Frequency Check docomo does work with existing carriers in France, albeit g8441 has more extensive coverage and might work better in certain cases/areas.
Almost certainly, in case of docomo you'll have to pay to get your bootloader unlocked if you want root or custom ROM on board (23GBP is the price last I checked). There are also small possibilities of either docomo with a freely unlockable bootloader, g8441 with a bootloader which has to be paid to unlock, or docomo advertised as g8441.
No matter the version, I would buy from a place that accepts (free) returns just to be on the safe side. Some ebay sellers offer them.
4qx said:
There is a difference in coverage of frequency bands between them. According to Frequency Check docomo does work with existing carriers in France, albeit g8441 has more extensive coverage and might work better in certain cases/areas.
Almost certainly, in case of docomo you'll have to pay to get your bootloader unlocked if you want root or custom ROM on board (23GBP is the price last I checked). There are also small possibilities of either docomo with a freely unlockable bootloader, g8441 with a bootloader which has to be paid to unlock, or docomo advertised as g8441.
No matter the version, I would buy from a place that accepts (free) returns just to be on the safe side. Some ebay sellers offer them.
Click to expand...
Click to collapse
Thanks a lot dude!! it's sad that there are some missing bands , it's hard to find a G8441 with decent price after having mine for 3 years, i check ebay quite often
4qx said:
There is a difference in coverage of frequency bands between them. According to Frequency Check docomo does work with existing carriers in France, albeit g8441 has more extensive coverage and might work better in certain cases/areas.
Almost certainly, in case of docomo you'll have to pay to get your bootloader unlocked if you want root or custom ROM on board (23GBP is the price last I checked). There are also small possibilities of either docomo with a freely unlockable bootloader, g8441 with a bootloader which has to be paid to unlock, or docomo advertised as g8441.
No matter the version, I would buy from a place that accepts (free) returns just to be on the safe side. Some ebay sellers offer them.
Click to expand...
Click to collapse
This is very interesting info. Thank you.
I am wondering if it could be possible to unlock the LTE band 20 on "docomo advertised as G8441" board?
I just happen to be the unlucky one to get Japanese version of xz1c motherboard unfortunately.
I'm probably late, but if you want bl unlocking the docomo version i think it's impossible even if with the mentioned software tool 23gbp, they have some dark magick locking on this version, even if you unlock it, you will run into problems flashing custom firmware i think this is all true I've owned a docomo xz1c as my main phone for more than one year, tried everything there is
Purplearyes said:
I'm probably late, but if you want bl unlocking the docomo version i think it's impossible even if with the mentioned software tool 23gbp, they have some dark magick locking on this version, even if you unlock it, you will run into problems flashing custom firmware i think this is all true I've owned a docomo xz1c as my main phone for more than one year, tried everything there is
Click to expand...
Click to collapse
It will be only with stock rom using temp root from J4nn, but since unlock 4g band b20 is impossible, I will need to learn to repair my broken one or spending 300€+ for a new one :/
asseforlife said:
It will be only with stock rom using temp root from J4nn, but since unlock 4g band b20 is impossible, I will need to learn to repair my broken one or spending 300€+ for a new one :/
Click to expand...
Click to collapse
I have tried the temp root for SO-02K and it sucks, after you disconnect the cable, root is gone, also its a root that doesn't allow you to do anything really. Useless
The purpose of J4nn's root is not to maintain it or end up with a fully open phone. You'd need to unlock the bootloader and install magisk for that.
The point of it is to be able to back up the various partitions and things (eg TA and DRM keys) that unlocking would normally erase -so that they can be restored...
tonsofquestions said:
The purpose of J4nn's root is not to maintain it or end up with a fully open phone. You'd need to unlock the bootloader and install magisk for that.
The point of it is to be able to back up the various partitions and things (eg TA and DRM keys) that unlocking would normally erase -so that they can be restored...
Click to expand...
Click to collapse
Still pretty useless for our docomo
@Purplearyes , no offense, but the fact that you do not know how to use a temp root exploit does not mean it is useless - it is very useful for others as you can see with other posts in this thread.
Particularly interesting seems to be the post #41 (linked from the OP too), that allows to prepare a setup for root after reboot without need for a PC with adb access.
And it is even more useful particularly for docomo, where you have no other (free) option, as official sony bootloader unlock method is not allowed.
Without the temp root you would not have any way to even try to experiment with diag interface to see if unlock of missing LTE bands could be possible or not.
Unfortunately the exploit is useful not only to us, but also to aliexpress sellers, who use it to cheat us by selling Japan SO-02K model with patched firmware to show itself as G8441 as documented here :-(
j4nn said:
@Purplearyes , no offense, but the fact that you do not know how to use a temp root exploit does not mean it is useless - it is very useful for others as you can see with other posts in this thread.
Particularly interesting seems to be the post #41 (linked from the OP too), that allows to prepare a setup for root after reboot without need for a PC with adb access.
And it is even more useful particularly for docomo, where you have no other (free) option, as official sony bootloader unlock method is not allowed.
Without the temp root you would not have any way to even try to experiment with diag interface to see if unlock of missing LTE bands could be possible or not.
Unfortunately the exploit is useful not only to us, but also to aliexpress sellers, who use it to cheat us by selling Japan SO-02K model with patched firmware to show itself as G8441 as documented here :-(
Click to expand...
Click to collapse
My bad. Your explanation was extremely helpful. I'm sorry
j4nn said:
@Purplearyes , no offense, but the fact that you do not know how to use a temp root exploit does not mean it is useless - it is very useful for others as you can see with other posts in this thread.
Particularly interesting seems to be the post #41 (linked from the OP too), that allows to prepare a setup for root after reboot without need for a PC with adb access.
And it is even more useful particularly for docomo, where you have no other (free) option, as official sony bootloader unlock method is not allowed.
Without the temp root you would not have any way to even try to experiment with diag interface to see if unlock of missing LTE bands could be possible or not.
Unfortunately the exploit is useful not only to us, but also to aliexpress sellers, who use it to cheat us by selling Japan SO-02K model with patched firmware to show itself as G8441 as documented here :-(
Click to expand...
Click to collapse
These fake g8441, wouldn't they return back the Japanese version if a factory reset was done? Or do they somehow truly modify oem partitions and are able to integrate them on Japanese firmware? If so, how come we can't do this ourselves, like patch the Japanese boot img with magisk and get root??
j4nn said:
@Purplearyes , no offense, but the fact that you do not know how to use a temp root exploit does not mean it is useless - it is very useful for others as you can see with other posts in this thread.
Particularly interesting seems to be the post #41 (linked from the OP too), that allows to prepare a setup for root after reboot without need for a PC with adb access.
And it is even more useful particularly for docomo, where you have no other (free) option, as official sony bootloader unlock method is not allowed.
Without the temp root you would not have any way to even try to experiment with diag interface to see if unlock of missing LTE bands could be possible or not.
Unfortunately the exploit is useful not only to us, but also to aliexpress sellers, who use it to cheat us by selling Japan SO-02K model with patched firmware to show itself as G8441 as documented here :-(
Click to expand...
Click to collapse
Fascinating. I hadn't been following that thread, so hadn't realized folks were doing that.
Unless I missed something, your root still isn't for Pie, right? Only Oreo?
So these folks are downgrading, rooting, flashing a wrong partition, then upgrading again? That's a lot of effort! Or I guess maybe they've found some other non-root method.
tonsofquestions said:
Fascinating. I hadn't been following that thread, so hadn't realized folks were doing that.
Unless I missed something, your root still isn't for Pie, right? Only Oreo?
So these folks are downgrading, rooting, flashing a wrong partition, then upgrading again? That's a lot of effort! Or I guess maybe they've found some other non-root method.
Click to expand...
Click to collapse
Utterly fascinating indeed
tonsofquestions said:
Fascinating. I hadn't been following that thread, so hadn't realized folks were doing that.
Unless I missed something, your root still isn't for Pie, right? Only Oreo?
So these folks are downgrading, rooting, flashing a wrong partition, then upgrading again? That's a lot of effort! Or I guess maybe they've found some other non-root method.
Click to expand...
Click to collapse
yes, the temp root is only for oreo
unfortunately yes, checkout my post with firmware version history - you can see there they downgraded to oreo from pie then went back to latest pie - they crafted oem overlays just to make SO-02K appear as G8441 - not nice at all :-(
Purplearyes said:
These fake g8441, wouldn't they return back the Japanese version if a factory reset was done? Or do they somehow truly modify oem partitions and are able to integrate them on Japanese firmware? If so, how come we can't do this ourselves, like patch the Japanese boot img with magisk and get root??
Click to expand...
Click to collapse
It is quite clever - it is actually very well done de-bloat of Japanese firmware, plus property overrides to force model to appear as G8441, also switched in TA so that it looks that way even in flash mode. Still not accepting other .sin files than those for SO-02K.
It survives also factory reset.
You can do similar modifications in oem, but that does not allow to get root in pie - they do not patch boot img, only oem. Boot (and system and vendor) partition is checked by verified boot with locked bootloader.
j4nn said:
It is quite clever - it is actually very well done de-bloat of Japanese firmware, plus property overrides to force model to appear as G8441, also switched in TA so that it looks that way even in flash mode. Still not accepting other .sin files than those for SO-02K.
It survives also factory reset.
You can do similar modifications in oem, but that does not allow to get root in pie - they do not patch boot img, only oem. Boot (and system and vendor) partition is checked by verified boot with locked bootloader.
Click to expand...
Click to collapse
Your explanations and Knowledge were an amazing gift. I appreciate it so much. Boosted my knowledge a lot.
Do you know other amazing tools we can use on a non rootable phone like this xz1c beauty. I use obvs utube vanced, i use button remapper for that extra key funcionality without root, i use grenify and naptime with adb. I de bloated with adb ofc.
Do you know more cool stuff? I wanna squeeze this docomo to its max.
Thanks brother
(on another note thinking about buying a g8441 motherboard but they go over 100 euro and can easily be a fake as you mentioned )
I purchased a G8441 new from ebay and had no idea it was a fake till 6 months later when it no longer worked on the Australian 3g 2100 band. (it worked on 4g for data and still did, but the phone would not work) I had a XZ2C Docomo SO-05K and an XZ2C G8314 that was also a SO-05K that had been flashed and sold as a G8314. I tried multiple things to get the VoLTE working but failed. I loved these phones but purchased a Samsung S10e and moved on.
@Purplearyes , @the baz or anybody else - can you please share me TA partition of your SO-02K (or the fake G8441 which is in fact SO-02K)?
I am on the verge of enabling LTE band 20 on my SO-02K, but I need to compare several TA partitions of that model in order to identify ta units that are device specific vs that are identical within the SO-02K model range.
Forgive my ignorance , but what is the TA partition?

Categories

Resources