Android on Such geek. Wow.

Flashing a Samsung S5 G900I back to stock

Tue, 19 Dec 2017 00:00:00 +1300

I got a second-hand Samsung Galaxy S5 for my mum yesterday (a G900I model, from Telstra), and I spent some time getting it ready.

Firstly, I downloaded the most-recent Telstra firmware image. At time of writing, that’s G900IDVU1CQJ2. Telstra appears to be the only carrier still releasing stock firmware for this phone, so I downloaded the Telstra version even though we’re connecting to Spark New Zealand. This means the phone will at least be running the most up-to-date baseband and modem firmware.

Note - if you try this, and find that the recent (international) version doesn’t work properly with your local carriers, download the older (local) package, and flash the modem.bin and the NON-HLOS.bin packages from the local one instead.

Flashing the new firmware required a little thinking. I’m 99% sure that I did this the hard way, but basically:

Download the newest version of Heimdall from Github
Back last year I had a post that mentioned editing CMakeLists.txt - ignore that now.

Build the software (assuming you extracted the zip instead of using git clone), with:

 cd Heimdall-master
 mkdir build
 cd build
 cmake -DDISABLE_FRONTEND=ON -DCMAKE_BUILD_TYPE=Release .. 
 make

Once I’d built Heimdall, I unzipped the firmware into a convenient place, and I examined the PIT file from the phone:

./heimdall print-pit

This descripts the partition table on the phone. In particular, it tells you which files in your firmware package should be uploaded to which partitions. I ended up with the following Heimdall flash line:

./heimdall flash --APNHLOS NON-HLOS.bin --MODEM modem.bin --SBL1 sbl1.mbn --DBI sdi.mbn --ABOOT aboot.mbn --RPM rpm.mbn --TZ tz.mbn --BOOT boot.img --RECOVERY recovery.img --SYSTEM system.img.ext4 --CACHE cache.img.ext4 --HIDDEN hidden.img.ext4

I know I could have only flashed the modem.bin and NON-HLOS.bin files, but I’m not sure what I would have missed by skipping all the other partitions.

After the phone was flashed up to the current Stock firmware, I made sure it booted correctly, and then went ahead and converted the phone to my beloved LineageOS, happy in the knowledge that all the “other bits” of the firmware were all updated.

Compiling Heimdall without installing Qt

Wed, 13 Sep 2017 00:00:00 +1200

During my recent Wrecked-phone Saga, I had some trouble flashing my firmware. My phone was broken at the time, so I couldn’t enable ADB Debugging - therefore adb wasn’t an option. OEM Bootlock was on, so fastboot wasn’t an option. My Recovery bootloader was also broken. I thought my phone was bricked.

That’s until I remembered Heimdall.

Heimdall is specifically a tool for working with the partitions on Samsung phones - other visitors need not apply. It works a treat for my Samsung Galaxy S5 (kltedv) though.

Heimdall, however, is old. The version in the Debian Sid repository is 1.4.1, which dates back to 2015. And when we have old versions, we also have incompatibilites! Such as Heimdall 1.4.1’s incompatibility with newer versions of Samsung devices … such as my precious SGS5.

Happily, Heimdall is open source, so I was able to download and compile a new version that overcomes the problem. And that’s how I found myself staring at the screen and looking at this:

That is Yuck.bat

I really didn’t want to install 55 packages just to build this. The majority of missing packages were required to build the GUI section of the tool, which I didn’t want to use anyway. What if I could … build Heimdall without building the GUI??

And of course, that’s the title of this article, so here’s how to do it!

EDIT 2017-12-19: The stuff below is no longer necessary. For better instructions, have a look at my article about flashing a Samsung G900I back to stock.

Clone the git repository, with git clone https://github.com/Benjamin-Dobell/Heimdall.git
Edit the CMakeLists.txt file: nano Heimdall/CMakeLists.txt

Delete the last four lines of CMakeLists.txt:

 cmake_minimum_required(VERSION 2.8.4)

 set(CMAKE_MODULE_PATH
 ${CMAKE_SOURCE_DIR}/cmake
 ${CMAKE_MODULE_PATH})

 project(Heimdall)

 set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)

 option(DISABLE_FRONTEND "Disable GUI frontend" OFF)

 add_subdirectory(libpit)
 add_subdirectory(heimdall)

You’re done! Go ahead and build according to the instructions.

When Encryption Attacks!

Tue, 12 Sep 2017 00:00:00 +1200

So… I wrecked my phone last night. :-(

Android’s phone encryption feature has been around for aaaages, so I was confident when I started the encryption process last night. Unfortunately, something went wrong, and last night I discovered that everything was toast.

After a bit of digging, I found someone else with exactly the same problem!

“unable to boot into my phone as it sits at the boot screen. When I try to boot into TWRP, it asks for my password. […] it appears to decrypt the partition and mount, but then while loading, TWRP shows a continuous stream of:

E:Error parsing XML file

errors until it just restarts.”

Unfortunately, nobody responded to my own personal denvercoder9.

Long story short, I lost everything. But for a while, I thought my entire phone was bricked. The phone wasn’t accessible in either Recovery mode (due to the XML parsing catastrophe) or Download mode - it wasn’t accessible either via adb or via fastboot.

Eventually my mate @rendition pointed out that I could just boot into Recovery, then cancel the decryption step and wipe my phone from there. That allowed me to start again from a clean slate.

And I encrypted my phone right away, with no trouble at all!

Updating the modem and radio firmware on a Samsung Galaxy 5 (G900I)

Thu, 27 Oct 2016 00:00:00 +1300

A couple months ago, Check Point revealed their discovery of the Quadrooter vulnerability affecting the Qualcomm chipsets in oodles of Android phones.

I use –CyanogenMod– LineageOS on a Samsung Galaxy S5, so thankfully I received patches for three of the four vulnerabilities in only a few days.

However, that last vulnerability was part of a proprietary binary blob for controlling the Qualcomm LTE chipset, only patchable by Samsung themselves. It took a while for the Samsung updates to roll out, and then I got distracted for a while, but I finally downloaded my firmware. The package I’ve used is “G900IDVU1CPH3”, which seems to be compatible at least with the three NZ-based carriers, as well as all the Australian carriers.

There are a couple little issues with the firmware upgrade, easily fixed if you know how. I’m going to assume you know exactly how to do everything without help. I’m sure you’re pleased.

In particular, the version of Heimdall in the Debian Sid repositories (1.4.1-2) doesn’t quite work with the SGS5. It appears other people have had similar problems.

The beginning of fix for me came from turboyz on Github, at the bottom of this post: (Edit 2020-04-12: GitHub Issue 348 from https://github.com/Benjamin-Dobell/Heimdall/ has been deleted); however, he’s manually made a couple changes to BridgeManager.cpp, which appear to be no longer necessary. We can simply build it from source:

sudo apt-get install build-essential cmake zlib1g-dev libusb-1.0-0-dev git
git clone https://github.com/Benjamin-Dobell/Heimdall.git
cd Heimdall

# OPTIONAL: Remove the `if(NOT DISABLE_FRONTEND)` codeblock at the end of Heimdall/CMakeLists.txt
# I believe this just saves time compiling the GUI

mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make
cd bin

Now you’ve got a nice new Heimdall installation, with the approproate updates to allow it to talk nicely to the new Samsung bootloader.

I copied my new baseband files into the Heimdall/build/bin folder, just to get them all together. The last step is to flash your NON-HLOS.bin and modem.bin files:

./heimdall flash --APNHLOS NON-HLOS.bin --MODEM modem.bin

I happen to have an issue on my phone currently where, even though the modem and LTE drivers have both been successfully installed, and even thought the Quadrooter tester is no longer showing any vulnerabilities, my Baseband version on my phone is still shown as the old one. I haven’t been able to figure out why yet, but I don’t think I’ll worry about it for now. There have been reports that you should first do this with –no-reboot, wait for the update to complete, then pull your battery, then when you power back on, immediately go back into download mode and re-flash. Apparently this helps update the recognised Baseband version, but to be honest it didn’t help me.

If you’re completely 100% lucky and absolutely nothing goes wrong, you win! You should now have the most recent Samsung modem and LTE chipset drivers available for your phone… without having to roll back to the stock Samsung firmware.

Incidentally, if you want to save gigabytes and time downloading said firmware, and if your phone is precisely a Samsung Galaxy S5 (G900I), and if you definitely want firmware G900IDVU1CPH3, I’ve extracted the important files (modem.bin and NON-HLOS.bin) and stored them here:

https://www.ericlight.com/files/G900IDVU1CPH3_modem_LTE.zip
SHA256 hash = a2ab13063583f6e83a3c2d8b79521a59ba103dda30a24bddf9248dd5a25bff3c

I promise I haven’t intentionally backdoored them, but I make no warranties of any sort. They might just be pictures of my foot.

Good luck!