Custom mode, recovery access, possible exploit location? - Verizon Galaxy S 5 Q&A, Help & Troubleshooting

Apologies if similar has been posted, but a cursory search didn't turn up anything.
Earlier today, I was playing Out There ( a great little space RPG) and my display, for lack of a better word, crashed. Lockscreen worked, etc. Anyway, being lazy and not wanting to strip off my otterbox for a batter pull, I decided to try to do a hardware reset. I ended up holding down every hardware button on my handset until my phone rebooted. It immediately jumped into the boot options and did a factory reset (goddammit). However, upon rebooting, the boot screen was slightly changed: It showed an unlocked padlock and the word "Custom" above the galaxy logo. It rebooted a couple times, and after the second reboot lost the "custom" logo; it then resumed normal operation. Knowing that we lack a root method to play with, I thought I'd try to figure out what I did to get to that screen, so I tried the "mash all the buttons approach". I've now ended up in recovery mode, and I am being greeted with the following:
Android System Recovery <3e>
KOT49H.G900VVRU1ANCG (I presume this is my handset's software version or something similar)
<Typical reboot, update through ADB/external storage, wipe data, wipe cache options, along with something interesting: Apply update from cache>
Below the menu, there is an output area with this:
# Manual Mode #
-- Applying Multi-CSC...
Applied the CSC-code: VZW
Successfully applied the multi-CSC
What, exactly, am I looking at, and what just happened? I highly doubt that my uneducated flailing somehow unlocked the encrypted bootloader, but perhaps something interesting happened that can be repeated to perhaps provide a better attack surface for exploit probing. Any thoughts from the more talented out there?
EDIT: Just wanted to add, as much as I want to use my phone, I won't be messing with it until I know that I've just found something that's already known about. Don't want to lose the opportunity to help the rooting search along.

FelixAurelius said:
Apologies if similar has been posted, but a cursory search didn't turn up anything.
Earlier today, I was playing Out There ( a great little space RPG) and my display, for lack of a better word, crashed. Lockscreen worked, etc. Anyway, being lazy and not wanting to strip off my otterbox for a batter pull, I decided to try to do a hardware reset. I ended up holding down every hardware button on my handset until my phone rebooted. It immediately jumped into the boot options and did a factory reset (goddammit). However, upon rebooting, the boot screen was slightly changed: It showed an unlocked padlock and the word "Custom" above the galaxy logo. It rebooted a couple times, and after the second reboot lost the "custom" logo; it then resumed normal operation. Knowing that we lack a root method to play with, I thought I'd try to figure out what I did to get to that screen, so I tried the "mash all the buttons approach". I've now ended up in recovery mode, and I am being greeted with the following:
Android System Recovery <3e>
KOT49H.G900VVRU1ANCG (I presume this is my handset's software version or something similar)
<Typical reboot, update through ADB/external storage, wipe data, wipe cache options, along with something interesting: Apply update from cache>
Below the menu, there is an output area with this:
# Manual Mode #
-- Applying Multi-CSC...
Applied the CSC-code: VZW
Successfully applied the multi-CSC
What, exactly, am I looking at, and what just happened? I highly doubt that my uneducated flailing somehow unlocked the encrypted bootloader, but perhaps something interesting happened that can be repeated to perhaps provide a better attack surface for exploit probing. Any thoughts from the more talented out there?
EDIT: Just wanted to add, as much as I want to use my phone, I won't be messing with it until I know that I've just found something that's already known about. Don't want to lose the opportunity to help the rooting search along.
Click to expand...
Click to collapse
Very curious indeed. There have been other posts about 'Custom' mode, from changing to ART from Davlik, but not like this. I am glad I read the whole thing, and not just wrote it off as 'another one of those duplicate threads'. *fingers crossed* for you my friend. I really hope this takes it somewhere as I am itching to get root! lol

Yes....I tried flashing SU from recovery mode. All I got was E: verification signature failed.
Sent from my SM-G900V using Tapatalk

sd_N said:
Yes....I tried flashing SU from recovery mode. All I got was E: verification signature failed.
Sent from my SM-G900V using Tapatalk
Click to expand...
Click to collapse
Out of curiosity sd_N, did your phone behave exactly like this one when you tried it?

kprice8 said:
Out of curiosity sd_N, did your phone behave exactly like this one when you tried it?
Click to expand...
Click to collapse
All it did was say E: signature verification failed. Then it rebooted as normal.
Sent from my SM-G900V using Tapatalk

From what I have gathered, things on the system partition are changing.
When you do a factory reset like that you are writing the csc to the system partition again which triggers the unlocked image on the boot screen.
Enabling ART will also cause it to happen.
Nothing exploitable there unless you can find a way to write your own data to system, which is the trick

Related

[Q] Can't wipe or factory reset encrypted phone

I made the mistake of encrypting my phone and am now paying the price. It is rooted and I had installed the Google Edition 4.4.2 ROM by Danvdh, Kryten2k35 & Ktoonsez. I'm using TWRP 2.7.0.1.
I first tried going into recovery and doing a factory reset and got the an "Unable to mount '/data'" error, followed by a big red FAIL. So I rebooted into the system and tried to do a factory reset from there. Went through all the steps, phone rebooted into recovery and I got the same error - unable to mount.
So I did a bit of searching on the forums here and someone had suggested using the format option in TWRP. So I did that and it seemed to work - did not get the dreaded unable to mount error. So I tried flashing the new rom (the updated version from a couple of weeks ago). Got a message indicating it was successful. Rebooted, and to my dismay, got the prompt for the encryption password. Saw the little line drawing Android, then... nothing - I found myself in brick land.
Managed to get back into TWRP and, based on another post I found, tried Advanced Wipe, selecting everything except Micro SDcard and USB-OTG. Tried installing the new ROM again, says successful, but nothing has changed - I still boot into blackness after inputting my encryption password.
Not sure what else to try. Any suggestions would be most appreciated.
not_su said:
I made the mistake of encrypting my phone and am now paying the price. It is rooted and I had installed the Google Edition 4.4.2 ROM by Danvdh, Kryten2k35 & Ktoonsez. I'm using TWRP 2.7.0.1.
I first tried going into recovery and doing a factory reset and got the an "Unable to mount '/data'" error, followed by a big red FAIL. So I rebooted into the system and tried to do a factory reset from there. Went through all the steps, phone rebooted into recovery and I got the same error - unable to mount.
So I did a bit of searching on the forums here and someone had suggested using the format option in TWRP. So I did that and it seemed to work - did not get the dreaded unable to mount error. So I tried flashing the new rom (the updated version from a couple of weeks ago). Got a message indicating it was successful. Rebooted, and to my dismay, got the prompt for the encryption password. Saw the little line drawing Android, then... nothing - I found myself in brick land.
Managed to get back into TWRP and, based on another post I found, tried Advanced Wipe, selecting everything except Micro SDcard and USB-OTG. Tried installing the new ROM again, says successful, but nothing has changed - I still boot into blackness after inputting my encryption password.
Not sure what else to try. Any suggestions would be most appreciated.
Click to expand...
Click to collapse
Can you go into download mode, revert back to a stock rom (or flash a stock one or something) and turn encryption off? edit: on further research it looks like the only way to completely unencrypt is to reset your device. dunno if that's something you'd want to try, but considering you already wiped multiple times.. i'd say try it?
Also what carrier do you have? That's pretty important. AT&Ts i337 and Verizon's variant cannot flash AOSP roms (more specifically, kernels) due to the bootloader being locked. That might be the issue you're experiencing? I looked up the ROM and it's using ktoonsez kernel, so I imagine that'd be why. Someone just made a version that does not include the kernel and has multiple issues the ROM you're trying to use fixed here.
Rhymey said:
Can you go into download mode, revert back to a stock rom (or flash a stock one or something) and turn encryption off? edit: on further research it looks like the only way to completely unencrypt is to reset your device. dunno if that's something you'd want to try, but considering you already wiped multiple times.. i'd say try it?
Thanks - that's exactly what I've been trying to do. I haven't tried reflashing back to stock with Odin though. Hmmm...
Also what carrier do you have? That's pretty important. AT&Ts i337 and Verizon's variant cannot flash AOSP roms (more specifically, kernels) due to the bootloader being locked. That might be the issue you're experiencing? I looked up the ROM and it's using ktoonsez kernel, so I imagine that'd be why. Someone just made a version that does not include the kernel and has multiple issues the ROM you're trying to use fixed here.
Click to expand...
Click to collapse
Bell, up here in the Great White North. I don't think locked bootloader is an issue - I was on the previous version of Danvdh's ROM, and everything was hunkydory. I just made the unfortunate decision to encrypt. Big mistake.
May try flashing back to stock. Nothing to lose, at this stage...
Thanks!
Hey just wanted to mention for the benefit of anyone else who got into this bind, flashing back to stock using Odin did the trick. Still wouldn't boot, but then I rebooted into stock recovery and did a factory reset, and finally was able to reboot back into stock. What a nightmare. Ugh. Thanks for the tip though - never occurred to me to try to go back to stock. Lesson learned though - no more encryption for me!
not_su said:
Hey just wanted to mention for the benefit of anyone else who got into this bind, flashing back to stock using Odin did the trick. Still wouldn't boot, but then I rebooted into stock recovery and did a factory reset, and finally was able to reboot back into stock. What a nightmare. Ugh. Thanks for the tip though - never occurred to me to try to go back to stock. Lesson learned though - no more encryption for me!
Click to expand...
Click to collapse
Good to hear. Should be able to flash to the rom once again no problem now that it's unencrypted!

I ****ed up. Hard.

Alright.
Specs: G900A Android 5.1.1, on AT&T (obviously)
I'm pretty inexperienced in messing around with phones, pretty good at messing around with other stuff.....not phones.
Tried rooting my phone, that was a no go, because I was on 5.1.1, and the program I was trying to use was 5.0 only. Alright, no biggie, I think. Spend 30min downloading 5.0, to flash using Odin. Find out it's 4.4. Decide, what the hell, i'll try anyways. (If you're keen, you can pinpoint this as being the spot where "I ****ed up") Boom. Bricked. only getting an ODIN screen, nothing else. Not done yet, I think. I'll just unbrick it, totally out of my territory, so i'm just flashing everything, most of which isn't working because of an error being spewed out during the beginning of the flash preventing anything from really happening. None of that works, I try this file i found on these forums titled "G900A_Downgrade_to_NCE.tar.md5" Nothing. I try a file I found on these forums titled "G900A_OC4_Stock_Kernel.tar.md5" on the AP path on ODIN, that's a go, good news, i'm think. Right? Wrong. After it restarts, it stays on the galaxy S5 screen, and doesn't continue, dude said he just had to restart his phone when that happened in the same thread it was mentioned in, so I try that, now I have to courses of action.
The error the PA installations came up with on my phones screen were "sw rev check fail"
1: Try to boot up normally, get stuck at S5 screen for eternity, cry my eyes out, assume the fetal position.
2: Pop into recovery mode,which lists my options as "Reboot system now" "Apply update from ADB" "Apply update from external storage" "wipe data/factory reset" (which i've done, hoping it would just perform magic and make things right again, all it really did was delete all of my data on my phone, oh well, there goes my texts to my boyfriend" "wipe cache partition" (Did this one too, as I was just out of options at this point) "Apply update from cache" None of these do anything helpful from what I can tell.
From the best I can tell, I have 4.4.2 partially installed on a system that originally had 5.1.1, which is a big no-no, and you can't do, and as far as I can tell, I am without a download menu. I have tried both Kies, and Smart Switch, which just freeze after I attempt device/firmware initialization. I have no backup, because why would I? That would make this all so much easier, and I am too stupid for that.
I am currently stuck in this predicament, and at this point, I don't care if my phone is rooted, if it's not rooted, if it's a freakin banana, as long as it's back the way it was, and I can do phone things with it. I will back down, and accept my life of TouchWiz peasantry. I just want it to work ;n;
Kill it with electronic lighter arcs and take it back to store saying its not working at all. And dont mention anything you have done. You simply wake up and it was not showing anything.
Have a read here
http://forum.xda-developers.com/galaxy-s5/help/odin-compatible-g900aucu4bof2-stock-rom-t3276309
Links to other threads with downloads are available in that thread
http://www.mediafire.com/download/b...398515_REV00_user_low_ship_MULTI_CERT.tar.rar
And try this OneClick recovery
http://forum.xda-developers.com/showpost.php?p=65234333&postcount=28

Phone restarts at startup.

Well this is my 1st post so first of all hey everyone
I just spent a week in Amsterdam and my phone restarted twice, different times different days and I dont remember what I was doing with it back then.
But as I landed back home I put the phone back from "Airplane Mode" and went on to toggle "Cellular Data" on.
The second I pressed the cellular data shortcut on my the phone restarted itself but this time whenever it would finish the screen would be on but fully black and sometimes it'll show battery precentage at the top but then will restart again in an infinite loop.
Sometimes it'll pop up the "Optimizing Apps" window and will go through all 24, upon finishing it will restart once more and do the same.
I tried using the bootloader and it worked (the bootloader that is) but the phone would do the same thing even after Rebooting from there or shutting down from there and then turning back on.
I contacted tech support on chat but they couldnt help past telling me to go to bootloader and reboot, said I should factory wipe when it failed.
Also tried wiping cache but to no avail.
I have no backup of my phone (wanted to do one before the flight but got lazy and I suck for not doing one sooner) since probably October and google doesnt backup my contacts properly for some unknown reason.
I already downloaded Android Studio with everything included for me to try using adb to sideload stock without wiping but its my first time and I couldnt get it to do anything at all...
I already got the official stock .gz file from the motorola website.
Anyway here are the specs to my phone:
XT1575
Everything is stock. didn't root or change recovery once in my life.
Was fully updated and had plenty of drive space (I have almost 128GB with the 64GB version + 64GB SD)
I'm really lost here so help will be very appreciated.
Thanks in advance,
-Noam
Start with a full wipe and if that doesn't work flash the stock image. Not sure what your question is though as you never really say. Once fixed I would unlock and make a backup so you don't have to deal with this again.
lafester said:
Start with a full wipe and if that doesn't work flash the stock image. Not sure what your question is though as you never really say. Once fixed I would unlock and make a backup so you don't have to deal with this again.
Click to expand...
Click to collapse
The thing I pretty much want to know is if theres a way to either backup the phone now with it connected to the computer while in bootloader or recovery. or a way to flash the stock rom without wiping which I read someone did with his tablet. I cant post source normally because I'm a new user so here it is but change spaces to dots: schnouki net/posts/2014/08/13/flashing-a-stock-android-image-without-wiping-user-data/
Also while in recovery I noticed 2 options under wipe: 1. userdata only. 2. userdata+(insert something I dont remember here) and I was wondering what gets deleted in both? if I delete only userdata what data will remain? something helpful?
Sure you can try flashing without wiping data but being locked I personally wouldn't risk it. No idea about backing up in your state... somewhere I remember a thread on backing up without root try searching in q&a.
lafester said:
Sure you can try flashing without wiping data but being locked I personally wouldn't risk it. No idea about backing up in your state... somewhere I remember a thread on backing up without root try searching in q&a.
Click to expand...
Click to collapse
Out of curiosity why shouldnt I try flashing with no wipe if ill lose the data anyway? worst case wont I just have to wipe after it fails and flash again?
And I will try thank you
Do you have any knowledge about the 2 wipe options?
Thanks in advance
Well I tried turning the phone on and it took a couple of minutes before loading to a fresh start. It apparently wiped itself on its own. Managed to restore almost everything.
Anyhow the phone takes too long to boot now. Was even stuck at boot and I had to restart it.
Anyway to fix my software? Or at least check for corruption?
Sent from my XT1575 using XDA-Developers mobile app

Soft brick or hard brick?? /cache mount issues on N7 (2012 grouper, 32gb)

Hey all,
First post here on XDA and I'm hoping someone with more experience than me will be able to give me a hand! Until last week or so, I was running an up-to-date version of Lollipop (5.1.1), when my tablet started randomly freezing up on me, requiring "soft resets" to get it going again, or simply shutting off on me. Thinking it was software related, I tried wiping the cache with no success, so ended up doing a full factory reset. The issues *seemed* to clear up for a day or so, but came back, and so figuring it was Lollipop related, I wiped out the OS and installed CM12.1 (which was my first experience working with ADB and fastboot, and first time installing a non-stock ROM) with a TWRP recovery. A few days later, the freezing and shutting down issues began popping up again, with the shutdowns *usually* happening during sleep, but the freezing happening at anytime from initial "Google" logo to boot animation, to the middle of running an app. I had made a backup on TWRP when I got CM12.1 configured the way I wanted it, so I performed a soft reset when it froze on me, and booted into the bootloader. The tab kept freezing in the TWRP window before I could select a restore, so out of desperation I tried just doing a factory reset from within TWRP. Long story short, something must have happened during that reset, because it kept hanging on the boot screen. I thought I may have unknowingly messed something up, so I tried downloading and flashing a stock KitKat (4.4) ROM from Google's site, but kept encountering bootloader errors during the flashing and ended up only being able to boot to the bootloader screen (apparently got a faulty 4.3 bootloader in that ROM, which gave me a headache until I was able to get straightened out). I have been able to get a stock bootloader (4.23) up and running now, along with a stock recovery (going with Lollipop now, so stock for LMY47V) going, but that's it. I've tried flashing the stock lollipop image via shell script (I'm running a Fedora 23 machine), via individual commands, and via "fastboot update -w factory_image.zip" without success. ADB sideload still works via recovery, but I wasn't able to sideload the OTA packages for 5.1 either. The common errors that pop up seem to indicate an error (corruption? fragmentation?) on the cache partition, but I'm not a dev when it comes to Android, so I'm at a loss here... I keep getting "E: failed to mount /cache (Invalid argument)", and other errors associated with accessing/opening files further down the /cache tree. Would this error be more likely to be a hardware issue, or would it be a software/firmware issue? I've had similar errors before with USB drives, when they would start to bad and partitions begin failing, but have always been able to rebuild them and get my data back. If something like this is happening on my N7 and the cache partition has indeed become somehow corrupted and failed (but not physically....), is it possible at all to rebuild partitions on Android in a similar manner? I've scoured the web, but haven't been able to find anything that can help me out with something like that, so I figured my best bet before condemning the N7 to the junk drawer was to see if any of the pros around here had any words of wisdom that *might* get me back up and running. Thoughts and advice much appreciated!!
Thanks!
(Oh, I apologize for the lengthy post, but I wanted to be sure to provide enough background info..... Sorry for the lengthy read!!)
Honestly that sounds more like a hardware problem than a software problem.
During the early stages of booting, everything that happens is extremely deterministic - meaning that it should be completely repeatable in terms of the order & timing in which activities occur.
So, for it to behave erratically during early boot suggests that it is not software, but marginal hardware. If hardware is barely meeting logic levels or timing requirements, a small amount of random noise (which is always present) can cause a fault to occur at any time - and that sounds approximately like what you are observing.
Further, you replaced your ROM entirely and the problem persists - again suggesting that the problem is hardware, not software.
The most cost effective way of dealing with repair of a $200 tablet is - unfortunately - disposing of it and buying a replacement.
Sorry.
Thanks for the reply!! Shoot, that's what I was leaning towards too. What is the life expectancy of these tablets? I mean, I got 3 good years of use out of it, so I'm not going to complain, but it seems like they should have lasted longer... Would it be worthwhile to maybe grab a cracked screen N7 off eBay for parts and try to get my tab working with those parts maybe? I'm hoping the rumors are true about Google coming out with a new tab this fall, but I'd love to get mine working before then lol...

Normal (rooted) phone, went full retard all of a sudden. Need help extracting data

Hello all,
I have a Nexus 6P, stock, rooted, with Xposed installed. The phone is completely functional for the better part of its life time since I bought it at release -probably first or second batch- (except for random reboots once daily on average, deemed by my investigation and exhausting all options to be a hardware issue or Xposed related).
Today, out of nowhere, the phone randomly rebooted itself and surprisingly it launched the "Android is starting..." dialogue which, if I'm not mistaken, optimize apps for ART. The battery was at 19% before it randomly rebooted, so when it started that optimize apps it went down to 0 (I assume) and it turned off. The charger wasn't connected correctly so that happened. Now the phone keeps restarting itself up to before it gives me the boot up decryption phase of the Data partition and reboots again. I assumed it can't decrypt Data for some reason, so I launched TWRP recovery to try and decrypt data and take a backup copy of my Titanium Backup folder on storage... Unfortunately, TWRP reports "failed to decrypt data" even though I'm 100% positive that the pattern is correct because I'm literally inputting it almost 10-20 times a day for the past two years...
Note: there seems to be a red blinking LED in the top left corner of the the phone. I never even knew this existed.
WHAT I WILL DO
I'll reflash everything system-wise.. I'm ok with that. I'll reflash the factory images, root it, install Xposed, no problem.
WHAT I NEED HELP WITH
I need to extract some folders from my phone storage, namely the Titanium Backup folder. I know the pattern protection of the encryption.
How do I go about doing this?
UPDATE:
Help is urgently needed now indeed: The phone doesn't even turn on to bootloader mode anymore now. It was able to, just half an hour ago. Now all I see it the red blinking LED.
UPDATE2: https://support.google.com/nexus/troubleshooter/3337561?hl=en-GB#ts=3337942
I'll try in 30 minutes.
Meanwhile, please help me with my original problem; extracting data.
I was thinking, if I boot into bootloader mode, can I use adb to pull any folder? If so, will that work in my case with decryption fails or Data partition doesn't seem to mount correctly?
Relevent:
Reviewing some other threads:
TWRP: 3.0.2-2
Bootloader: UNLOCKED
I did NOT upgrade to Android 7.0 nor was I planning to, until Xposed is available.
I did NOT flash anything **new** recently. However, Installed an Xposed module yesterday which caused a bootloop. I rebooted into TWRP, uninstalled Xposed, rebooted into system (which looped once, out of the ordinary) and I uninstalled that module, back to TWRP installed Xposed, and rebooted back into system. It worked for 12 hours and then what I wrote this post for happened as stated above.
UPDATE3:
15 minutes into charging... NOT EVEN A RED BLINKING LED ANYMORE.
Last? UPDATE:
Almost 1 and a half hour into charging and there is no longer ANYTHING. Is it hard-bricked now?
How the **** is this possible? I'm very much capable of solving any sof-brick but not a hard-brick...
Thats a really crappy scenario. Im a little busy right now (not that I can get you out of this regardless) but I sort of skimmed through your post. Are you able to connect adb? If so you might be able to use "adb pull" to get that data.
On my 6p TB is located at:
/storage/emulated/0/TitaniumBackup/
Itll probably be the same location on your phone. Good Luck
KLit75 said:
Thats a really crappy scenario. Im a little busy right now (not that I can get you out of this regardless) but I sort of skimmed through your post. Are you able to connect adb? If so you might be able to use "adb pull" to get that data.
On my 6p TB is located at:
/storage/emulated/0/TitaniumBackup/
Itll probably be the same location on your phone. Good Luck
Click to expand...
Click to collapse
I was indeed able to connect to a PC after I saw the problem (the bootloop essentially)... But I didn't at the time as I didn't have a plan of action as to how to get my data, so I turned it off. After sometime, I couldn't do anything with the phone... Not able to boot into bootloader, not recovery, the phone is essentially not turning on to anything, not even the splash screen; like a hard-brick. I'm not sure if this indeed is a hard brick as I've never seen any.. and don't currently know what to try next.
Is the LED still showing? if so, do the bootloader boot combo, and see if fastboot devices gets a response in a command prompt - or terminal if you're a linux guy.
if so, you can boot to twrp, decrypt data - try default_password -, and browse the phone's files from your computer's file browser, the phone will show up as Nexus 6P. That's my suggestion, wish you luck.
TnT_ said:
Is the LED still showing? if so, do the bootloader boot combo, and see if fastboot devices gets a response in a command prompt - or terminal if you're a linux guy.
if so, you can boot to twrp, decrypt data - try default_password -, and browse the phone's files from your computer's file browser, the phone will show up as Nexus 6P. That's my suggestion, wish you luck.
Click to expand...
Click to collapse
I honestly declared it hard-bricked.
Will Fastboot show any devices if the phone didn't show bootloader screen?
I'll try again today.
Update:
Didn't work.
check out my post
[Guide] Fool/Noob proof way to do clean installs on Nexus Devices
http://forum.xda-developers.com/nexus-6p/general/guide-fool-noob-proof-to-clean-installs-t3518311

Categories

Resources