SM-S367VL support #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This is the third bootloader-locked Exynos device I own. Mine is currently borrowed and has been for quite a few months, but supposedly I'll get it back at some point in January.
Well um... You see I live in the United States, and the borrower moved to a state other than mine, and I don't think I'm crazy enough to go on a road trip to get back the device or anything... It's a shame, I really became interested in this specific phone once I learned it had an exynos7885 (or exynos7884a which is just an underclocked one)...
I have a relative in Canada with the exact same phone, though. Maybe I can get it from him (maybe my family will visit him again?), especially if I trade the SM-J327VPP I got from him for it Still, I haven't really looked into rooting that phone yet...
So since I probably won't have testing hardware soon (if ever) I'll just try to port the phone using its bootloader image; I can't just use upload mode to figure out where the PIT chunk will be and whatnot, but I suppose I can guess using other phones' addresses. I already can find the load address using a previous upload mode dump, fortunately. Maybe someone else will test it...
After looking around in Ghidra and finding some addresses, I made some untested info in
ee332c3097.Notes: the bootloader is at offset
0x61800insboot.bin, loaded to address0x8f000000in memory, and its uncached heap begins at0x90500000not counting the root chunk.Well I asked said relative about testing it, and he ended up deciding to just mail me the phone! Let's just hope this phone has revision <= 9 (otherwise I won't be able to downgrade the bootloader to run this exploit)