Samsung gear s3 reactivation lock

[imed2002]

i got s3 gear frontier with samsung lock ,can you help me please
sm-r760

[adfree]

Okidoki...

ODIN Protocol maybe easier...

Seems require TCP Server... Upload protocol was TCP Client...

First success... ODIN answer over WiFi with:
LOKE



Need some time to prepare files for sending few lines of HEX...

So I hope I will manage this year... dumping PIT from Gear over Wifi...

Best Regards

[adfree]

Mühseelig ernährt sich das Eichhörnchen...

Its not so easy to find fully usable and easy to handle TCP Server Tool to fire up 25 Commands in a row...

Tried few Android apps on my GT-I9300... but limitation is to use more then 1 Command with 1024 byte to send... in HEX...

Similar problems with free available PC Windows Tools...


On Screenshot is result visible... after sent Command 2

First Command is easy... in ASCII or HEX...
ODIN or 4F44494E

Second command seems to show ODIN Protocol Version... IMHO.

Screenshot is valid for my both Wearables:
SM-R732
and
SM-R760

6400000000000300

This shows my SM-Z130H also via USB...

And my old GT-I9300 shows lower "Protocol Version"... but Commands are same to dump PIT...

6400000000000200

Now I think maybe I have more luck with NetCat on Windows PC...
And creating stupid Batch file *.bat

Maybe something like this work:
https://stackoverflow.com/questions/...tcp-connection

found the solution. Its nc 127.0.0.1 1200 < binary.bin In addition, if the response needs to be saved then
nc 127.0.0.1 1200 < binary.bin > response.bin

Need some time for tests...

Best Regards

[adfree]

Untested!
Status:
Feuchter Traum

Under Construction...
Based on this Theory:
https://stackoverflow.com/questions/...tcp-connection

This is my idea how to dump PIT... partition.pit from Wearables over WiFi... instead USB cable.

I will check my theory on my SM-R732 first... if nothing explode...
Then my SM-R760...


Now I have to fight with NetCat on my old Vista Notebook.

Best Regards

[adfree]

Seems easier... with NetCat...

Command looks like this:

nc -l -p 13579 < ODINcommand_full.bin > response_full.bin

But I have to put all 25 files -->into 1 single file


Best Regards

[adfree]

First success to dump PIT partition.pit from Wearables over WiFi...
Tested with my 2 devices:
SM-R732
SM-R760

I see some red text on Screen... but at the moment I can ignore...
Tested only with Combination Firmware...

Own risk!

NetCat I have taken from here:
https://eternallybored.org/misc/netcat/

Tested on my old Windows Vista Notebook... with this Version:
netcat-win32-1.12.zip


I will check now if I can use Phone + Android App... to send these 25 KB...
to receive 7 KB result...


Best Regards

[adfree]

Stuck with Upload Commands...

As I have no newer device to connect via USB and to sniff what is send...

Download (Wireless) and
Upload (Wireless)

in rootfs.img

/usr/bin/wireless-download

Upload "Commands" RDX related seems:

wu_rdx_cmd_search_idx
wu_rdx_cmd_powerdown
wu_rdx_get_cmd_size
wu_rdx_cmd_preamble
wu_rdx_init
wu_rdx_cmd_search_addr
wu_rdx_cmd_data_transfer
wu_rdx_generate_log
wu_rdx_dump_info_init
wu_rdx_add_dump_entry
wu_rdx_handle_cmd
wu_rdx_do_upload_file
wu_rdx_send_cmd
wu_rdx_cmd_probe
wu_rdx_recv_ack

Download "Commands" netODIN related:

wd_odin_send_ack
wd_odin_handle_cmd
wd_odin_get_cmd_size
wd_odin_get_version
wd_odin_cmd_pit
wd_odin_cmd_xmit

My IDA qualities still 0

Attached are files from SM-R760... taken from different Firmware Versions...

Best Regards

[adfree]

Please I need Tester for dump/read PIT partition.pit via WiFi.

Thanx in advance.

I have tested with my SM-R732 and my SM-R760...
... with Combination Firmware only
On my old Notebook with 32 bit Windows Vista...


Need help to confirm it work... on normal Stock Firmware...
On Tizen 3 Firmware...

I have attached netcat + Batchfile + Command Binary in 1 package...
+ Video


Maybe somebody can test or have ideas how to improve netcat Batch...
So I don't need to press ctrl + c

Thanx in advance.

Best Regards

[adfree]

nc -l -w 5 -p 13579 < ODINcommand_full.bin > response_full.bin

-w 5 Parameter is for listen 5 seconds... so ctrl + c is obsolete...

Added corrected Version...

Best Regards

[saeid js]

i write combination file on my gear s3.

[adfree]

i write combination file on my gear s3.

If you need help.
Feel free to PM me.


@all
Meanwhile we have RL removed from few more devices.

For instance:
SM-R360 Gear Fit 2 = STEADY partition is on p15
SM-R730 series = STEADY partition is on p22

All possible if Combination Firmware is available...
And simple with WiFi only...
NO wires NO USB cable required

Only as info.

Still I need Korean Firmware or PIT file for:

SM-R765S
SM-R765K
SM-R765L

Nothing avalaible yet...
No Stock Firmware nor Combination FTMA nor FT30...

Best Regards

[adfree]

I am too old as it seems... or too much Vodka.
SM-R730 series have STEADY on partition 26...

Attached new RL off collection...

But SM-R360 p15 like SM-R760/SM-R770 is correct.

In theory it is very easy to identify where STEADY is...
1 way is to check simple PIT file... partition.pit
So no device mandatory to search for STEADY or to confirm it is correct...

Best Regards

[adfree]

SM-R600 Gear Sport not tested...
No idea if Samsung changed something in Security...

STEADY partition is p17...

If somebody willing to test...
PM me for help.

Best Regards

[adfree]

CSC_OKS_R775SOKS2CQL2_usr.tar.md5
CP_R775SKSU2CQJ4_CL401035_QB7878159_SIGNED.tar.md5
BL_R775SKSU2CQL2_usr.tar.md5
AP_R775SKSU2CQL2_usr.tar.md5

We are coming closer...

Will test if PIT is signed with same key like SM-R765S...

Best Regards

[adfree]

Meanwhile we have 1 SM-R765 alive again.
With mix of sboot.bin + cm.bin from SM-R765S...
+ PIT from SM-R775
+ Firmware from SM-R775 (few files removed)...
We have now working CQL2 Firmware.

Best Regards