Database Users

[Q] How can I tell if I'm running tampered firmware?

Hey XDAers,
I bought a used Samsung Focus off ebay and I noticed a peculiar firmware boot up on it. IIRC, it had a screen that said "no SIM", some big text that said "retry in XXXXXX minutes" but had the usual emergency calling button. Seemed a little different looking than what I'm familiar with (I've had two WP7s already). Using the emergency dialer I couldn't even enter the diagnostics mode. Even hooking up USB zune would report that the device was "locked" I thought this all seemed fairly phishy, so I did a hard reboot on the phone and it returned to the usual initial firmware state that I would have expected the first time, just like it should.
I'm running through WP7 updates now, but I'm just wondering, is there still a chance my phone is running a rogue firmware even after these updates? Can I be confident that the Zune updater will verify authenticity of the running firmware on the device?
Thanks in advance!

yay4furryanimals said:
I'm running through WP7 updates now, but I'm just wondering, is there still a chance my phone is running a rogue firmware even after these updates? Can I be confident that the Zune updater will verify authenticity of the running firmware on the device?
Thanks in advance!
Click to expand...
Click to collapse
If you run an update that includes firmware, it will overwrite the current firmware, thus easing your mind.

I figured this to be the case. Was just a little worried about the boot loader being compromised.

Another RMA disaster...

I bought my Pure Edition about a month ago. A week and a half ago, I wake up and check Google Now for the weather and the phone shuts down and is fried. It has been hot a lot, but I heard it was normal and no big deal. I went through the ordeal of getting a replacement phone a week ago Monday. I then got the email saying it would ship the day after it was received. Sweet! I was thrilled! Only 3 days with a cheap prepaid temp phone. So it doesn't get delivered on that Thursday as stated. Or the next day. I call them to check on it and they said it wasn't going to be here until Today. Surprise! I got it a day early! Yes! However, they sent me a phone that had the bootloader still locked, but the software was modified so I can't use it for work as it shows compromised in Airwatch. I'm fairly certain my account has been flagged, but that's another issue to fix. I called them again today. They will send me a new one. Again. Another week without a phone that I bought only a month ago. I really wish they had the Nexus 6 in stock the day I bought this because that is the one I wanted. I absolutely loved by 2013 Moto X. This one, not so much. The several people I was transfered between had no idea what compromised means on the bootloader. The last guy, thought that the bootloader was used for loading Airwatch in the first place. Has anyone else recieved a phone from the OEM that was compromised or modified software? Slowly, but surely losing faith in this company.

That's a disaster? We must have a very different definition of that word

OK, So I am a little upset by it all, but I just bought the phone a month ago and now I am going to be without it for 2 out of the 5 weeks of ownership. Maybe its not the RMA process, but that I am having to go through it so soon and twice at that.

I do agree that is a PITA. I bought mine used and did not have this experience. It's funny you say you liked the 2013, because I actually very much disliked the 2013 and could not be happier with my 2014.
I'm not quite following the modified software thing. They sent you a phone with a locked bootloader but was not all the way stock? I found that either a) AirWatch does not look for whether the bootloader is locked/unlocked, or b) my firm did not include that in the AirWatch policies or whatever. I unlocked my bootloader, installed TWRP, and rooted, and my phone showed up as compromised. I returned to pure stock with stock recovery, but kept my bootloader unlocked, and had no problems clearing AirWatch. I've heard the same from others on XDA. But I find it weird that Moto would ship out a phone that had compromised software. Even if it was one someone else returned, you would think it would be standard policy to ensure it is completely wiped and returned to full on factory stock condition.

anidrin said:
Has anyone else recieved a phone from the OEM that was compromised or modified software?
Click to expand...
Click to collapse
I would return it again. This is Moto's fault for having these flags in the first place.

Yeah, shipping it locked is not a surprise, showing up in Airwatch as compromised when it's still stock recovery, locked, and non rooted? That's odd.

Paddington said:
I'm not quite following the modified software thing. They sent you a phone with a locked bootloader but was not all the way stock?
Click to expand...
Click to collapse
There is a root checker on Motorola phones since I think ICS days. If a device has never been rooted it's status is 0/0, if it is currently rooted it is 1/1 and if it was rooted and unrooted it is 0/1. If it is either of the latter 2, it will show as modified software in bootloader mode.
---------- Post added at 01:12 AM ---------- Previous post was at 01:11 AM ----------
scottricketts said:
Yeah, shipping it locked is not a surprise, showing up in Airwatch as compromised when it's still stock recovery, locked, and non rooted? That's odd.
Click to expand...
Click to collapse
No it's not, it means it has been rooted in the past.

JulesJam said:
There is a root checker on Motorola phones since I think ICS days. If a device has never been rooted it's status is 0/0, if it is currently rooted it is 1/1 and if it was rooted and unrooted it is 0/1. If it is either of the latter 2, it will show as modified software in bootloader mode.
---------- Post added at 01:12 AM ---------- Previous post was at 01:11 AM ----------
No it's not, it means it has been rooted in the past.
Click to expand...
Click to collapse
Did you try running a root checker app to see if the phone is currently rooted? Because my device was rooted, but reflashing a stock unrooted system made my phone go from compromised to compliant on our AirWatch system. And our AirWatch policies are pretty strict, because they have to meet the security tests of our clients with the strictest security policies, and we are a big law firm that represents most of the Fortune 100 and nearly (or every) major bank.
Although I do agree with your initial stance that there is really no excuse for them to ship you a pre-rooted phone without you requesting it. In the past, that would have saved me 10 minutes, but now, it would be a hassle.

Paddington said:
Did you try running a root checker app to see if the phone is currently rooted?
Click to expand...
Click to collapse
I did it with my N6. I know the phone is unrooted as I flashed a stock system image. In the bootloader mode, it still says software is modified.
This is well known to be how it works with Motorola phones.
Paddington said:
Although I do agree with your initial stance that there is really no excuse for them to ship you a pre-rooted phone without you requesting it. In the past, that would have saved me 10 minutes, but now, it would be a hassle.
Click to expand...
Click to collapse
His phone wasn't pre-rooted - it had been rooted in the past and that then creates the 0/1 state.

JulesJam said:
I did it with my N6. I know the phone is unrooted as I flashed a stock system image. In the bootloader mode, it still says software is modified.
This is well known to be how it works with Motorola phones.
His phone wasn't pre-rooted - it had been rooted in the past and that then creates the 0/1 state.
Click to expand...
Click to collapse
So I just tried this out. I booted into fastboot and it says my device is UNLOCKED, and then it says:
"Status Code: 3"
"Software Status: Official"
I unlocked this phone, flashed TWRP, and rooted it. I screwed around with it, downloaded a few root apps (busybox, rootbrowser, quick boot), then saw it was listed as compromised on AirWatch. I used a toolkit to do a full wipe and revert back to stock, unrooted 4.4.4 and factory recovery. I then upgraded to 5.0 through the OTA. I never relocked the bootloader. My device showed up as compliant when I redownloaded AirWatch.
And I still agree with the original premise that Motorola should have made sure this didn't happen originally--which is why they are going to fix it--but I'm not understanding why he can't get around this the same way I did. I'm not understanding why he is showing up as a modified software while I am not.

Paddington said:
So I just tried this out. I booted into fastboot and it says my device is UNLOCKED, and then it says:
"Status Code: 3"
"Software Status: Official"
I unlocked this phone, flashed TWRP, and rooted it. I screwed around with it, downloaded a few root apps (busybox, rootbrowser, quick boot), then saw it was listed as compromised on AirWatch. I used a toolkit to do a full wipe and revert back to stock, unrooted 4.4.4 and factory recovery. I then upgraded to 5.0 through the OTA. I never relocked the bootloader. My device showed up as compliant when I redownloaded AirWatch.
Click to expand...
Click to collapse
Hmm, that is not what is happening with my N6 or on the Droid Turbo forums for those who are using MoFo. For us, once we root, that is it, even unrooting, flashing back to stock doesn't reset that root check flag.

JulesJam said:
Hmm, that is not what is happening with my N6 or on the Droid Turbo forums for those who are using MoFo. For us, once we root, that is it, even unrooting, flashing back to stock doesn't reset that root check flag.
Click to expand...
Click to collapse
If it was just Droid Turbo, I'd guess it has to do with the MoFo exploit and the fact that it is not supposed to be unlocked and rooted. And by "not supposed to be," I of course mean in the eyes of Verizon, because it is ridiculous that a company will not let you unlock your bootloader on a $600 phone once you've fully paid it off. But that is beside the point. The fact that it is also happening with your Nexus 6 pretty much defeats my theory that it is MoFo causing it.
Could it be that when I updated through a true OTA, like went to Settings > About Phone > Updates, it reset this counter? Or, ignoring the counter for a moment, that the true OTA update re-established my system as being 100% unmodified stock--"Software Status: Official"? Troubleshooting based on recent experiences without the ability to test my hypotheses (it is my work phone ,after all) is driving me nuts.

Paddington said:
The fact that it is also happening with your Nexus 6 pretty much defeats my theory that it is MoFo causing it.
Click to expand...
Click to collapse
I just flashed my N6 back to total stock using factory images and relocked it. Software status says modified and bootloader status is status code 2 locked (which means relocked). And AFAIK, this is what everyone's experience on a Motorola phone is:
Locked Status Code 0 = never been unlocked before by the fastboot oem unlock command
Unlocked Status Code 1 = unlocked in its original factory state and never been locked before*
Locked Status Code 2 = locked but has been unlocked before
Unlocked Status Code 3 = currently unlocked
*You can't buy a phone in the Status Code 1 Unlocked state in the US. You can buy them off of Tao Bao and they are referred to as "factory" devices. They are "removed" from the Chinese factory before they are locked. However, I would not do that as I am not sure if they are on the global blacklist or not.
The Software state can be any of the following:
qe 0/0 = never been rooted
qe 1/1 = currently rooted
qe 0/1 = not currently rooted but rooted at some point in the past
States qe 1/1 and qe 0/1 will show the Software status as modified IME. So Software Modified means modified currently or at some point in the past.

Can you remove the unlocked bootloader warning when powering on device?

As the title implies. Is this possible? if so, how?
I'm talking about the one that says "your device can't be checked for corruption" .... etc

No

It's not the end of the world, but I'm hoping that someone will find a workaround for this.
Seeming that it's allowed and doesn't break manufacturers warranty, it seems rather odd to consistently display this at boot after the first time.

It's because you bootloader is unlocked, therefore it doesn't pass certain security checks. It's like that with the Nexus 6p and I'm sure it's like that with the pixel. That will never change I don't believe.
Also becareful not to ever lock your bootloader while you have a custom recovery installed or you will brick your device.

Eric214 said:
It's because you bootloader is unlocked, therefore it doesn't pass certain security checks. It's like that with the Nexus 6p and I'm sure it's like that with the pixel. That will never change I don't believe.
Also becareful not to ever lock your bootloader while you have a custom recovery installed or you will brick your device.
Click to expand...
Click to collapse
My Nexus 4 and 6 didnt have that warming but my Moto E 2015 does. I think its based on the phone. All UNLOCKED Bootloader.

Warning Sucks!

It's a security requirement set by Google (to show a warning message like that) as part of the agreement for OEMs to use Android on their devices. It will not be going away anytime soon.

The Axon 7 has a patch to get rid of this warning...

Essential PH-1 downgrade

Hello yall!
So I am at a complete loss on how to fix the issues with my Essential device.
So I decided to post here in as much detail as I can and hopefully receive some answers.
I purchased my phone used from eBay about a month ago.
According to the listing it was factory unlocked.
I have AT&T prepaid.
Everything was running smoothly for about a week until I receive the notification for the Android Pie OTA.
(At this time my bootloader was not yet unlocked nor was I rooted).
Again everything was fine UNTIL I installed the security patch update.
As soon as I installed and rebooted my sim read as invalid.
I rebooted, tried to mess with network settings, factory reset, etc.
Turning to Google, I realize this is a common issue with the Sprint variant of this device (of course my luck would be for me to unknowingly purchase the Sprint variant not knowing there was any issues) and the pie update.
The main fix for this issue would be of course to downgrade back to Android 8.
Here's my issues...
I unlock my bootloader.
Install the Android 8 firmware from the official Essential site. (made sure to install the one for Sprint variant).
Flash.
The touch screen is not functional. At all.
Flash back to Android Pie and install TWRP
Flash Android 8 custom ROM.
Touch screen still not functional.
So I'm back on Android Pie and touch screen is working, but sim is still invalid.
How are other essential users successful in downgrading the software?
HELP.

stephxo said:
Hello yall!
So I am at a complete loss on how to fix the issues with my Essential device.
So I decided to post here in as much detail as I can and hopefully receive some answers.
I purchased my phone used from eBay about a month ago.
According to the listing it was factory unlocked.
I have AT&T prepaid.
Everything was running smoothly for about a week until I receive the notification for the Android Pie OTA.
(At this time my bootloader was not yet unlocked nor was I rooted).
Again everything was fine UNTIL I installed the security patch update.
As soon as I installed and rebooted my sim read as invalid.
I rebooted, tried to mess with network settings, factory reset, etc.
Turning to Google, I realize this is a common issue with the Sprint variant of this device (of course my luck would be for me to unknowingly purchase the Sprint variant not knowing there was any issues) and the pie update.
The main fix for this issue would be of course to downgrade back to Android 8.
Here's my issues...
I unlock my bootloader.
Install the Android 8 firmware from the official Essential site. (made sure to install the one for Sprint variant).
Flash.
The touch screen is not functional. At all.
Flash back to Android Pie and install TWRP
Flash Android 8 custom ROM.
Touch screen still not functional.
So I'm back on Android Pie and touch screen is working, but sim is still invalid.
How are other essential users successful in downgrading the software?
HELP.
Click to expand...
Click to collapse
Go to the guide section and read the post that says uicc unlock there is a solution outlined.just follow it and your phone will be back in service

stephxo said:
Hello yall!
So I am at a complete loss on how to fix the issues with my Essential device.
So I decided to post here in as much detail as I can and hopefully receive some answers.
I purchased my phone used from eBay about a month ago.
According to the listing it was factory unlocked.
I have AT&T prepaid.
Everything was running smoothly for about a week until I receive the notification for the Android Pie OTA.
(At this time my bootloader was not yet unlocked nor was I rooted).
Again everything was fine UNTIL I installed the security patch update.
As soon as I installed and rebooted my sim read as invalid.
I rebooted, tried to mess with network settings, factory reset, etc.
Turning to Google, I realize this is a common issue with the Sprint variant of this device (of course my luck would be for me to unknowingly purchase the Sprint variant not knowing there was any issues) and the pie update.
The main fix for this issue would be of course to downgrade back to Android 8.
Here's my issues...
I unlock my bootloader.
Install the Android 8 firmware from the official Essential site. (made sure to install the one for Sprint variant).
Flash.
The touch screen is not functional. At all.
Flash back to Android Pie and install TWRP
Flash Android 8 custom ROM.
Touch screen still not functional.
So I'm back on Android Pie and touch screen is working, but sim is still invalid.
How are other essential users successful in downgrading the software?
HELP.
Click to expand...
Click to collapse
Did you unlock your critical partitions along with the bootloader?

arjunv said:
Go to the guide section and read the post that says uicc unlock there is a solution outlined.just follow it and your phone will be back in service
Click to expand...
Click to collapse
Do you think you could link that post for me? I can't seem to find it.
I also don't see any uicc option on my debice. (Not sure or that matters though)

If it's Sprint you need to wait 50 days before you can unlock it. CDMA phones are a pain in the ass to unlock, always buy International if possible!
This thread has some information that might be useful:
https://forum.xda-developers.com/essential-phone/help/unlock-sprint-version-t3720727
Sent from my PH-1 using XDA Labs

SuperBrolySSJ said:
Did you unlock your critical partitions along with the bootloader?
Click to expand...
Click to collapse
This is required for the touch screen firmware to be flashed and OP needs to see this.

Well, that didn't go well

Tab 5se Stock firmware
So I bought a 3rd 5se from a third party, all I checked for was for FRP lock, well it wasn't locked, but when I got it home and rebooted, it says is has a unlocked bootloader. So I hard factory reset it and now it states that only stock firmware can be installed in boot and won't go any further.
So I'm guessing I need to use ODIN to flash a factory ROM but I'm not sure which one as I can't seem to find a USA one on Sammoble, I do see a Canada one though.
Which version of ODIN should I use (WIN 10)
Which ROM, I'm in the USA, WIFI ONLY SM-T720, country code ?
Any other tips, as I haven't flashed anything in almost a decade probably.
Need to get this back to all stock, help

You want the XAR country code version which is the US rom. For Odin, use the newest version for our tablet. Good luck.

puredigital said:
Tab 5se Stock firmware
So I bought a 3rd 5se from a third party, all I checked for was for FRP lock, well it wasn't locked, but when I got it home and rebooted, it says is has a unlocked bootloader. So I hard factory reset it and now it states that only stock firmware can be installed in boot and won't go any further.
So I'm guessing I need to use ODIN to flash a factory ROM but I'm not sure which one as I can't seem to find a USA one on Sammoble, I do see a Canada one though.
Which version of ODIN should I use (WIN 10)
Which ROM, I'm in the USA, WIFI ONLY SM-T720, country code ?
Any other tips, as I haven't flashed anything in almost a decade probably.
Need to get this back to all stock, help
Click to expand...
Click to collapse
I use Frija instead of Sammobile to get the latest stock. Just use SM-T720 as the model and XAR as the CSC. If you search for how to unlock the bootloader, you can use the same proceedure to relock it. It should perform a factory reset as part of the process and you might not need to reflash a ROM.

Not sure..
Since the device won't turn off, restart nor go into download mode
Aqua blue sorta cyan screen. Top in red (like a terminal response) says," Only official released binaries are allowed to be flashed (vbmeta)"
Then on main screen in center;
Security Error: This phone has been flashed with unauthorized software & is locked. Call your mobile operator for additional support
lewmur said:
I use Frija instead of Sammobile to get the latest stock. Just use SM-T720 as the model and XAR as the CSC. If you search for how to unlock the bootloader, you can use the same proceedure to relock it. It should perform a factory reset as part of the process and you might not need to reflash a ROM.
Click to expand...
Click to collapse

puredigital said:
Since the device won't turn off, restart nor go into download mode
Aqua blue sorta cyan screen. Top in red (like a terminal response) says," Only official released binaries are allowed to be flashed (vbmeta)"
Then on main screen in center;
Security Error: This phone has been flashed with unauthorized software & is locked. Call your mobile operator for additional support
Click to expand...
Click to collapse
The only time a ran into a situation where I couldn't turn off that tablet, I just had to put it aside for a day or so till the battery ran down. Then use the method of holding both vol up and down, and NOT power, and then plugging in the cable from the PC. Must be from PC and not charger.

puredigital said:
Since the device won't turn off, restart nor go into download mode
Aqua blue sorta cyan screen. Top in red (like a terminal response) says," Only official released binaries are allowed to be flashed (vbmeta)"
Then on main screen in center;
Security Error: This phone has been flashed with unauthorized software & is locked. Call your mobile operator for additional support
Click to expand...
Click to collapse
I ran into this recently when I went back to stock to get the fingerprint for Magisk Module and then went back to Lineage. You just need to Odin the factory firmware. The tablet will turn off, I think the key combination to force it off is power and volume down? Its been a few weeks, but I was able to get back into download mode. I found other threads for samsung phones that had this same issue and basically used them as rough guides.
As mentioned you just need to use XAR ROMs, your box should say XAR. I believe both Canada and Cellular South ROMs will come up as XAR roms IIRC?

Bruh. I had the same issue and you will not be able to flash your way around and FRP lock. I found a guy on eBay to remove the FRP lock and NOT through flashing. For $10 is was done in 10 minutes. I get if you want to figure it out. I'm a flasher and love to figure this **** out too but with a recent update Samsung blocks this. Trust me. Spend $10 and it's done. Also many people say they can do this on eBay. I only recommend this guy: https://www.ebay.com/itm/273424666857. Just select a new auction of his and message him.
Sent from my SM-T720 using Tapatalk

elcidroyale said:
Bruh. I had the same issue and you will not be able to flash your way around and FRP lock. I found a guy on eBay to remove the FRP lock and NOT through flashing. For $10 is was done in 10 minutes. I get if you want to figure it out. I'm a flasher and love to figure this **** out too but with a recent update Samsung blocks this. Trust me. Spend $10 and it's done. Also many people say they can do this on eBay. I only recommend this guy: https://www.ebay.com/itm/273424666857. Just select a new auction of his and message him.
Sent from my SM-T720 using Tapatalk
Click to expand...
Click to collapse
He said he checked to make sure this was not the FRP lock. Assuming this is the same message I got which says only official binaries can be flashed, please take this to a service center and it there maybe a cost involved (obviously I'm paraphrasing), you can fix it with Odin. I was on the latest firmware as well, as I updated fully to get the fingerprint for the MagiskHide module. This sounds like a different issue, to me.
I mean if that works it's $10 well spent I guess.

Oh my apologies as I misread his post. I just saw "FRP" and chimed in. Hope he gets it sorted out.
OhioYJ said:
He said he checked to make sure this was not the FRP lock. Assuming this is the same message I got which says only official binaries can be flashed, please take this to a service center and it there maybe a cost involved (obviously I'm paraphrasing), you can fix it with Odin. I was on the latest firmware as well, as I updated fully to get the fingerprint for the MagiskHide module. This sounds like a different issue, to me.
I mean if that works it's $10 well spent I guess.
Click to expand...
Click to collapse

Almost !
Well, I finally reflashed the device with factory stuff, it's working fine now, no locks, except now it tells me the bootloader is unlocked on boot. I flashed it with Odin, no options, just loaded the 4 files and done.
How do I get this to STOCK, out of the box status. Steps ?