Develop Bugs

New Exploit on Verizon Galaxy S9 G960U???

Hi everyone,
So it has been a year since I have my S9 and still there is no exploit released to the public yet, and I understand that Samsung really locked down the security on their US variants.
On the Samsung S6, what I used to have, had an exploit where you can only have shell root access in terminal by modifying the boot.img and flashing it via odin, and thats using Android Nougat for root.
Could this perform a similar function to the S9? Like at least have an exploit where you can have shell root via ADB?
If not, is there any status on the G960U in terms of rooting?

AndroidFan16 said:
Hi everyone,
So it has been a year since I have my S9 and still there is no exploit released to the public yet, and I understand that Samsung really locked down the security on their US variants.
On the Samsung S6, what I used to have, had an exploit where you can only have shell root access in terminal by modifying the boot.img and flashing it via odin, and thats using Android Nougat for root.
Could this perform a similar function to the S9? Like at least have an exploit where you can have shell root via ADB?
If not, is there any status on the G960U in terms of rooting?
Click to expand...
Click to collapse
modifying the boot.img will cause the signature from sammy to fail as would anything else that isnt stock and properly signed.
No dice man. Still nada on the U devices. You do know that root is becoming less and less necessary, right? What are you looking to get done with root?

youdoofus said:
modifying the boot.img will cause the signature from sammy to fail as would anything else that isnt stock and properly signed.
No dice man. Still nada on the U devices. You do know that root is becoming less and less necessary, right? What are you looking to get done with root?
Click to expand...
Click to collapse
Ohh... Well that's kind of a dud.
I always want root mainly for more control with my device, for example, uninstalling bloatware (this way if I dare to factory reset my device, I dont need to disable the apps I dont want after performing a factory reset, unless if I have to reflash the rom).
Another thing is controlling the CPU's frequency speed (or governor) for either saving battery or pump out more performance, which is technically the #1 thing I want as root.
I also want to disable OEM updates from forcing me to update my phone after 10 defers (I found a bug to bypass this and it's by using the notification draw and click on the setting button).
I also want to configure access of changing the 4G LTE bands (which changing the config file in the /efs partition, which I assume, is locked without su access).
Like I have mentioned, the shell root is basically minimum for me, and I wouldn't mind on that. HOWEVER, if all that I have mentioned can be performed without root and have a similar function of doing these, please let me know.

AndroidFan16 said:
Ohh... Well that's kind of a dud.
I always want root mainly for more control with my device, for example, uninstalling bloatware (this way if I dare to factory reset my device, I dont need to disable the apps I dont want after performing a factory reset, unless if I have to reflash the rom).
Another thing is controlling the CPU's frequency speed (or governor) for either saving battery or pump out more performance, which is technically the #1 thing I want as root.
I also want to disable OEM updates from forcing me to update my phone after 10 defers (I found a bug to bypass this and it's by using the notification draw and click on the setting button).
I also want to configure access of changing the 4G LTE bands (which changing the config file in the /efs partition, which I assume, is locked without su access).
Like I have mentioned, the shell root is basically minimum for me, and I wouldn't mind on that. HOWEVER, if all that I have mentioned can be performed without root and have a similar function of doing these, please let me know.
Click to expand...
Click to collapse
youre not gonna get true debloating with this, but if you flash the U1 firmware with an unknown CSC, it wont install any carrier bloat and is very much akin to a GSI. Nice and stripped down. Over/unclocking, yup, you need root. I never see people talking about clockin the processor anymore tho as the new kernels are so adaptive and are written quite well. Ive also never not wanted to install an OEM update, so im not sure how to stave those off, or if ite even possible. To change the bands your phone is utilizing, you just need access to the special menu from the dialer.

Do you know what's the dialer code to access the service menu on the S9 on Verizon?
I'm pretty sure its locked but it's worth a try.

doubts about whether to continue using root or unroot and relock the bootloader

I came across this post on GitHub
https://github.com/topjohnwu/Magisk/issues/2534
I wanted to ask if I should continue using root or just relock my phone ?

tanzeel.ahmed1306 said:
I came across this post on GitHub
https://github.com/topjohnwu/Magisk/issues/2534
I wanted to ask if I should continue using root or just relock my phone ?
Click to expand...
Click to collapse
Unlocking your bootloader and rooting your devices is a choice that you and only you can make. There are always risks when modifying your devices. When you unlock the bootloader on most devices it will void your warranty unless stated otherwise by the manufacturer.
When it comes to root access there is always a chance for things to stop working. That is why it is up to you to do your research and make an informed decision before taking any action.
To some people, including me, an unlockable bootloader and gaining root access over a device is a must. I am paying for it and I want to use my devices how I see fit.
If you are concerned about an issue that may arise because you have an unlocked bootloader and root access I always try to look at it from both sides. Why did I unlock the bootloader? Why did I root? Am I able to do what I intended to do or not?
Sent from my OnePlus HD1907 using XDA Labs

tanzeel.ahmed1306 said:
I came across this post on GitHub
https://github.com/topjohnwu/Magisk/issues/2534
I wanted to ask if I should continue using root or just relock my phone ?
Click to expand...
Click to collapse
I'm kinda in the same boat. While I don't use GPay that often (and I can currently use it through Magisk), occasionally it would be nice for it to work without issue. However, the main reason I root is so that I can manually edit my HOSTS file to block ads.
Like fast69mopar mentioned, it's an individual preference. What do you gain by unlocking the bootloader and rooting?
In my opinion, the OP7T is a fantastic phone right from the get-go. So was the OP6T. Both phones I used for almost a full week before unlocking and rooting.

Got the OP7T a month ago and was faced with the same decision. All phones since Samsung Galaxy I have rooted.
Decided not to root the OP7T. So far couldn't be happier. Maybe missed it once. Everything working without issue is nice.
As for Ads.
Built in Private DNS in Android 10 with dns.adguard.com works pretty damn good.

I'm rooted, using magisk and edxposed with aosip. Definitely no loss of function comparing to stock. I don't use Google pay, but Samsung pay, bank apps, snapchat, everything works. Currently magisk and edxposed could be hidden without any loss of function when it comes to bank or paying apps. I don't use Google pay but safety net passes just fine with my setup

fast69mopar said:
Unlocking your bootloader and rooting your devices is a choice that you and only you can make. There are always risks when modifying your devices. When you unlock the bootloader on most devices it will void your warranty unless stated otherwise by the manufacturer.
When it comes to root access there is always a chance for things to stop working. That is why it is up to you to do your research and make an informed decision before taking any action.
To some people, including me, an unlockable bootloader and gaining root access over a device is a must. I am paying for it and I want to use my devices how I see fit.
If you are concerned about an issue that may arise because you have an unlocked bootloader and root access I always try to look at it from both sides. Why did I unlock the bootloader? Why did I root? Am I able to do what I intended to do or not?
Click to expand...
Click to collapse
Thanks a lot for your response
I actually rooted because I wanted to use substratum themes and enable aux module in gcam. Apart from that no other reason.
So I guess I am not missing out on too much .
I actually unrooted my phone and relocked the bootloader.
But again thanks for the response!

I had unlocked the bootloader and tried a couple of custom ROMs a few months back but decided it isn't worth it because my main hindrance of adblocking is addressed using DNS and any unneeded app can be disabled using adb. On the flip side, I need Widevine L1 for Netflix/Prime and no custom ROM can offer that on the 7T.
Makes more sense to me to stay within the walled garden, especially with the higher risk brought about by rogue Android apps that are now far too prevelent. The mods too are not that much value adding than it was may be when I first started using custom ROMs nearly a decade ago.

Note 10 Model Numbers

I'm looking at buying an international Exynos N10, and running it on Verizon in the US.
My purposes in doing so are to either use root to make the phone as bulletproof as possible, or flash a rom onto it that focuses on security and privacy. Been rocking iphones for a while (last phone I rooted and rommed was the GS4, then Verizon started locking all the snapdragon bootloaders.
Anyway, there seems to be a wide range of available models to choose from. Is there one I should gravitate towards for my specific purposes?
I seem to see N975F mentioned a lot.

all the US snapdragons have the bootloader locked
the china model snapdragon doesn't
the F model doesn't
the question is can you achieve what you want w/o rooting the phone?
some of the advantages for rooting might be possible to be achieved also w/o root via ADB commands
read and try to get as much info as possible to be able to understand the ups and downs of rooting or not rooting
also consider if you want to sell the phone afterwards - how rooting would affect that sale
also a hint - unlocking the bootloader will "burn" the knox fuse which is irreversible - no more automatic OTA, only manual and a few specific apps will not work

w41ru5 said:
all the US snapdragons have the bootloader locked
the china model snapdragon doesn't
the F model doesn't
the question is can you achieve what you want w/o rooting the phone?
some of the advantages for rooting might be possible to be achieved also w/o root via ADB commands
read and try to get as much info as possible to be able to understand the ups and downs of rooting or not rooting
also consider if you want to sell the phone afterwards - how rooting would affect that sale
also a hint - unlocking the bootloader will "burn" the knox fuse which is irreversible - no more automatic OTA, only manual and a few specific apps will not work
Click to expand...
Click to collapse
also rooting will kill the private folder. Privacy can be achieved with debloating for example and private DNS / VPN
Rotting will seriously damage the resale and future official support as well as the safety net and payments.

Is it worth to root your Samsung Galaxy S10+

Hello,
Yesterday, I successfully rooted my Samsung Galaxy S10+. But since I still had some questions about it, I went on and posted a thread here. User Spaceminer then pointed out that my original post was in the wrong subforum and linked me here. Naturally, I looked at some of the most popular posts in hopes to find answers to my questions. But what I found confused me more than it gave me answers.
Since 2014 with the Samsung Galaxy S5 I got used to rooting in order to disable bloatware, protect my data and customize my phone. I continued doing that with the S8+ until I recently got my hands on the S10. Now, my main reason for rooting are still the same; I want disable (not necessarily uninstall) bloatware, protect my privacy and customize my phone (such as changing the background of the dial when calling someone). But that thread made me wonder if it is even essential to root. I also found a similar post on reddit and most answers seem to agree that it is not necessary to root your phones.
Now, my situation is a bit different. For one, I already rooted my phone. Second, I don't care about warranty nor custom ROMs. But I do want to install a banking app. Also, it is a bit cumbersome to not only have to manually update your phone with every update but the booting requirements with the warning screen are also a bit annoying. So, my question is the following:
What are the advantages of rooting that are not possible without? I have 3 main concerns: Bloatware, Privacy and Customization.
The reason why I posted this in a separate threat is that I was not able to come to a definitive conclusion on my own and most discussion threads are over a year old. By now, the whole process of rooting and what is possible changed since then, so I want to get a more recent insight. I hope you can help me out.
With kind regards,
DasMalzbier

Tbh root is not needed, unless you want to use a custom rom. Most things are already in the android now.

Calyx os not make for samsung Galaxy series and 12 update also comes this year so i think rooting is unnecessary for s10 series

Root is 100%, absolutely necessary for using the phone. I cannot use any phone without it. Critical root-only capabilities:
full system backups (in twrp)
titanium backup
disable updates permanently (update ONLY when want to)
app freezers (app quarantine)
disable/remove bloatware
disable google play services/google play
automate/tasker
cf lumen
adblockers
wifi tether
busybox
superuser
ssh tunnel
update android to later version / install custom roms
optimize system
button mapper
custom theming / substratum
nav gestures
tidypanel
xposed
root explorer
app privacy customizations
3c all-in-one toolbox
more
Without root, the phone is unusable to me. I will never buy any phone without root capability. I am willing to go to different carriers just to get root on the device, or go to different manufacturers if root is blocked. For example, I will never buy a huawei device - they are locked.

I would like to say yes but I can't. the stock apps are very well designed.
The biggest concern is that custom Roms are released faster than modded apps.
For example I tried about ten GCAMs and all of them have a bug... and it becomes more complicated with Exynos.
OpenGcam is not worth samsung app.
Unable to get voice match to work.
Alarms that you can't set to a specific day with the google app.
And so on.
Root is useful when the manufacturer no longer updates the devices.
I regret having Root mine because I lost Samsung Pay and other things.

DemotionFR said:
I would like to say yes but I can't. the stock apps are very well designed.
The biggest concern is that custom Roms are released faster than modded apps.
For example I tried about ten GCAMs and all of them have a bug... and it becomes more complicated with Exynos.
OpenGcam is not worth samsung app.
Unable to get voice match to work.
Alarms that you can't set to a specific day with the google app.
And so on.
Root is useful when the manufacturer no longer updates the devices.
I regret having Root mine because I lost Samsung Pay and other things.
Click to expand...
Click to collapse
The only one that would have any consequence of rooting is Samsung Pay.

xbt- said:
Root is 100%, absolutely necessary for using the phone. I cannot use any phone without it. Critical root-only capabilities:
full system backups (in twrp)
titanium backup
disable updates permanently (update ONLY when want to)
app freezers (app quarantine)
disable/remove bloatware
disable google play services/google play
automate/tasker
cf lumen
adblockers
wifi tether
busybox
superuser
ssh tunnel
update android to later version / install custom roms
optimize system
button mapper
custom theming / substratum
nav gestures
tidypanel
xposed
root explorer
app privacy customizations
3c all-in-one toolbox
more
Without root, the phone is unusable to me. I will never buy any phone without root capability. I am willing to go to different carriers just to get root on the device, or go to different manufacturers if root is blocked. For example, I will never buy a huawei device - they are locked.
Click to expand...
Click to collapse
can you carrier /network unlock with the root >?

NickosD said:
Tbh root is not needed, unless you want to use a custom rom. Most things are already in the android now.
Click to expand...
Click to collapse
No, even if you wanna use custom rom you don't need to root. Just pick the rom with the apps you want or just use the gapps packages you want, if want essential to work gapps then use pico or nano. If there is still something you want to remove and the romdoesn't allow, just use adb shell commands and thats it. Less issues with banks not working because of Magisk (root). I know Magisk has a feature to hide itself, change its name but depending on the app, the libs can be found and know that is Magisk, so for security purposes some apps don't work and some aren't even shown in the Google Play Store just because you rooted the device.

logandavid said:
maybe now the root is not needed but later down the road when your phone will get obsolete and newer android OS updates will be halted for S10+ then you'll be more attracted towards custom roms. Actually it is just personal preference.
Click to expand...
Click to collapse
It's happening right now, I doubt S10+ will receive Android 13 and now just security and bug fix updates are being shipped by Samsung.

Haknor said:
It's happening right now, I doubt S10+ will receive Android 13 and now just security and bug fix updates are being shipped by Samsung.
Click to expand...
Click to collapse
It won't get any new Android upgrades AFAIK.
But appart from tripping knox, what else do I lose if I unlock my bootloader? I read once, quite a while ago, that the battery is limited to 80% of its full capacity. Is that true?

io_gh0st said:
It won't get any new Android upgrades AFAIK.
But appart from tripping knox, what else do I lose if I unlock my bootloader? I read once, quite a while ago, that the battery is limited to 80% of its full capacity. Is that true?
Click to expand...
Click to collapse
Depending on the version, you'll notice stock camera to be limited or not work as expected, secure folder, dual messenger either not working, it can trigger some banks or payment apps (especially if you root), no more ota updates (if you keep using stock rom), drm content can stop working, samsung pay, Play Store might limited the apps you see and so on... Not sure about the battery, for me unlocking the bootloader and switching to another rom made my battery last more than stock, but it depends on the rom, the device, it's not a rule of thumb.

General XDA Article: PSA: Dirty Pipe, the Linux kernel root vulnerability, can be abused on the Samsung Galaxy S22 and Google Pixel 6 Pro

https://www.xda-developers.com/dirty-pipe-root-demo-samsung-galaxy-s22-google-pixel-6-pro/
March 15, 2022 7:40am Comment Skanda Hazarika
PSA: Dirty Pipe, the Linux kernel root vulnerability, can be abused on the Samsung Galaxy S22 and Google Pixel 6 Pro​
What happens when a Linux privilege-escalation vulnerability that also affects Android gets disclosed publicly? You got it! Security researchers and Android enthusiasts around the world try to take advantage of the newly found problem to create an exploit, which can be used to gain advanced access to your device (such as root or the ability to flash custom images). On the other hand, device makers and a few determined third-party developers quickly take the responsibility to patch the backdoor as soon as possible.
This is exactly what happened to CVE-2022-0847, a vulnerability dubbed “Dirty Pipe” in Linux kernel version 5.8 and later. We talked about the exploit in detail last week but didn’t explicitly cover the potential abusing scenarios on Android. Now, XDA Member Fire30 has demonstrated an exploit implementation around the kernel flaw that can give the attacker a root shell on the Samsung Galaxy S22 and the Google Pixel 6 Pro.
The key point here is that you don’t need any kind of unlocking or other trickery to make it work – the Dirty Pipe exploit allows the attacker to gain root-level access on the target device through a reverse shell via a specially crafted rogue app. At the time of writing, flagships like the Google Pixel 6 Pro and the Samsung Galaxy S22 are vulnerable to the attack vector even on their latest software releases, which shows the exploit’s potential. Since it can also set SELinux to permissive, there is virtually no hurdle against unauthorized control over the device.
From the perspective of the Android modding scene, Dirty Pipe might be useful to gain temporary root access on otherwise difficult-to-root Android smartphones, e.g., some regional Snapdragon variants of the Samsung Galaxy flagships. However, the window won’t last long as the vulnerability has already been patched in the mainline Linux kernel, and OEMs will probably roll out the fix as part of the upcoming monthly security updates. Nonetheless, stay away from installing apps from random sources for the time being to protect yourself. In the meantime, we expect that Google will push an update to the Play Protect to prevent the vulnerability from being exploited via rogue apps.
Source: Fire30 on Twitter
Via: Mishaal Rahman
Click to expand...
Click to collapse

This isn't necessarily bad news if the exploit is used non-maliciously. Could be beneficial for Verizon customers looking for a way to gain root.

westhaking said:
This isn't necessarily bad news if the exploit is used non-maliciously. Could be beneficial for Verizon customers looking for a way to gain root.
Click to expand...
Click to collapse
Could, yes. I'll remain pessimistic that it'll actually happen, and of course, it'll take someone willing to actually do the work. A very limited time to do it doesn't help unless someone with a spare Verizon device keeps it off the network/internet until something is implemented.

westhaking said:
This isn't necessarily bad news if the exploit is used non-maliciously. Could be beneficial for Verizon customers looking for a way to gain root.
Click to expand...
Click to collapse
I was just reading about this & that exact thought came to mind. The root access gained seems to be temporary, but if you can write to usually read only file system, could you not theoretically write a Magisk boot image (using dd, or in Magisk Manager itself?) or even toggle the OEM unlock switch via a SU shell command unlock the phone?
I'm not very well versed on how the mechanics behind OEM unlock switch in developer settings works & or how Verizon locks these phones down (UK based), but I would assume that it could be useful to help find a exploit for phones running any pre-April 22 update.
Edit: from my limited knowledge, can you not sideload a earlier OTA on Verizon devices? I know you could do so with Pixel 3 and earlier, but I haven't been following it too closely with later devices.

DanielF50 said:
or even toggle the OEM unlock switch via a SU shell command unlock the phone?
Click to expand...
Click to collapse
I've never heard of a shell command that could toggle the OEM unlock. That doesn't mean it hasn't existed, but I doubt it, otherwise, I would think on all the Verizon devices I used to have, and just root threads in general I should remember anyone making the suggestion, even if it required temporary root first.
DanielF50 said:
Edit: from my limited knowledge, can you not sideload a earlier OTA on Verizon devices? I know you could do so with Pixel 3 and earlier, but I haven't been following it too closely with later devices.
Click to expand...
Click to collapse
I was under the impression that all phones with the bootloader locked that you could never, ever downgrade via any method. Also, OTAs generally use deltas/differencing to patch known good files of version A to version B, and B to C, so applying a version B OTA to a device that's on version C would fail because the files on the device are the wrong version.
Like (let version A be represented with the value 1, B with 4, and C with 9):
Device is on version B, so "4".
OTA to go from B to C comes.
OTA says is device file "4"?
Yes! Add 5 to the file, it's now "9".
and then
Device is on version C, so "9".
Try to put the B to C OTA on the device.
OTA says is device file "4"?
No! It's "9", quit OTA process.
This might be simplified, and anyone correct me if I'm wrong, but this has definitely been the case some and I believe almost all, if not all, the time. The OTA files can be smaller that way because they don't contain replacement files. They only contain what the difference is between the old file and the new, which is usually much smaller than the entire file.