G955F RMM State locked, asking password

[pashamangl]

could you upload RLC.apk?thanks in advance

[BillA]

Originally Posted by pashamangl

could you upload RLC.apk?thanks in advance

Here's the RLC and Ice Box apps.

Samsung_RLC_v1.1.15.APK
https://www.androidfilehost.com/?fid=673956719939818841

Ice_Box__Catching_Now_v3.2.0.APK
https://www.androidfilehost.com/?fid=962187416754459725

To avoid a downgrade error when installing the apps, use this command:
adb install -d -r -t Samsung_RMM_v1.1.15.APK
adb install -d -r -t Ice_Box__Catching_Now_v3.2.0.APK


After the RLC app is frozen you can try these steps to remove the RMM lock:
1. In build.prop set "ro.security.vaultkeeper.feature" property to 0, like this:
ro.security.vaultkeeper.feature=0

2. Using a root file manager delete the folder "/system/priv-app/Rlc".
To do this, select "/system/priv-app" folder and delete "Rlc".
OR
adb shell pm uninstall --user 0 com.samsung.android.rlc

[BillA]

Originally Posted by BillA

To avoid a downgrade error when installing the apps, use this command:
adb install -d -r -t Samsung_RMM_v1.1.15.APK
adb install -d -r -t Ice_Box__Catching_Now_v3.2.0.APK

Sorry about the small mistake in the app name

adb install -d -r -t Samsung_RMM_v1.1.15.APK
should be
adb install -d -r -t Samsung_RLC_v1.1.15.APK

[DJNJ]

Originally Posted by BillA

Here's the RLC and Ice Box apps.

What are my options if my RMM State is Prenormal?

Brand new phone, bought from Samsung.
I just want to install TWRP.

I did the 7 day wait trick without rebooting, completed 168 hours uptime, but the RMM State line didn't dissappear from my download mode. It was showing prenormal.

OEM Unlock is visible and off
FRP Lock is also off.

Still Odin won't allow to flash TWRP, shows the remaining installment balance error.

Any help is much appreciated!

[gsm_service4u]

Originally Posted by DJNJ

What are my options if my RMM State is Prenormal?

Brand new phone, bought from Samsung.
I just want to install TWRP.

I did the 7 day wait trick without rebooting, completed 168 hours uptime, but the RMM State line didn't dissappear from my download mode. It was showing prenormal.

OEM Unlock is visible and off
FRP Lock is also off.

Still Odin won't allow to flash TWRP, shows the remaining installment balance error.

Any help is much appreciated!

RMM will always stay there, will just go to NORMAL and OEM Unlock line will appear in developer options, enable it and flash TWRP

[BillA]

Originally Posted by DJNJ

What are my options if my RMM State is Prenormal?

Brand new phone, bought from Samsung.
I just want to install TWRP.

I did the 7 day wait trick without rebooting, completed 168 hours uptime, but the RMM State line didn't dissappear from my download mode. It was showing prenormal.

OEM Unlock is visible and off
FRP Lock is also off.

Still Odin won't allow to flash TWRP, shows the remaining installment balance error.

Any help is much appreciated!

From what I understand RMM is now independent of the OEM-Unlock option, so even if OEM-Unlock is enabled, RMM can still be active (i've seen this today on J3 OEM=ON, FRP=ON). The solution for now, is to leave it turned on continuously (do not power off and on or touch it for over 7 days, or better yet for 8-days).

Try these RMM disabling solutions, then after reboot try to turn on OEM-Unlock.
Steps to remove the RMM lock:
1. Freeze/uninstall the RLC app
adb shell pm uninstall --user 0 com.samsung.android.rlc

2. In build.prop set "ro.security.vaultkeeper.feature" property to 0, like this:
ro.security.vaultkeeper.feature=0

3. Using a root file manager delete the folder "/system/priv-app/Rlc".
To do this, select "/system/priv-app" folder and delete "Rlc".

[niceguy786]

Anyone come up with another solution for this ? Bought phones and it turned up to be these.
Thank You

[ukrhaker]

At note 8 n950f after this procedure the phone does not turn on, hangs on the screen saver samsung. What are the ideas of what can be done?

[djbyron8a]

Originally Posted by lordofthepings

Some time ago I helped a friend, who got swindled on eBay with an RMM locked phone and the seller was not responding. Please note that this fix is "partial" and the tutorial is from my memory so I may be forgetting some details. Therefore, do this at your own risk, you have been warned

The phone was a Galaxy S8+ (SM-G955F) from Telcel Mexico with G955FXXU1AQH3 firmware, it had "FRP Lock" set to "Off" and "OEM Lock" set to "On". Phone could only be flashed with stock or combination firmware and could not be rooted as custom binaries were blocked. I flashed stock firmware from several regions but every time the phone got locked in 10 seconds after reaching the welcome screen. I observed that the phone was locked using an RMM (Remote Mobile Manager) account, because of pending installment balance. If I had the RMM account details tied to this phone, I could go to rmm.samsung.com and unlock it. Since the seller never provided that, I thought of blocking the software that was triggering the lock. In my research, I found that the lock was being triggered by RLC.apk which is located at "/system/priv-app/Rlc/Rlc.apk" in stock firmwares. I followed the steps below to bypass the lock (your situation might be a bit different from mine so follow the below steps at your own risk):

1. Install combination firmware (I used FA70_G955FXXU1AQD1). Once the phone boots up in factory firmware, you will notice that the "USB Debugging" is On but "OEM Unlock" option is missing. Don't worry, we will fix that later.
2. Install RLC.apk v1.1.15 from PC (adb install Rlc.apk)
3. Install Ice Box v3.1.9.1 from PC (adb install com.catchingnow.icebox-3.1.9.1-G-varies-sdk21-vc593.apk)
4. Since we do not have Root permission, set Ice Box as a Device Administrator from PC (adb shell dpm set-device-owner com.catchingnow.icebox/.receiver.DPMReceiver)
5. Restart the phone
6. Open up Ice Box, continue as Device Admin and in the APPS section, "Freeze" the RLC package (Title: Notification, Description: com.samsung.android.rlc). You may need to enable the "Include Hidden" option in Ice Box from the top right corner.
7. Now that RLC is frozen, install stock firmware with "HOME_CSC" so that the two apps we installed do not get erased. I used "AP_G955FXXU1AQH3", "BL_G955FXXU1AQH3", "CP_G955FXXU1AQH3" and "HOME_CSC_OWA_G955FOWA1AQH3" from the Telcel firmware.
8. We are done, remember to keep RLC package frozen.

After step 7, I changed the language to English from Settings and also disabled OEM Lock from "Developer Options". A few observations at this point:

1. The phone is still RMM locked, we have only suppressed the SEM_LOGISTICS PIN Code prompt. You can see "RMM State: Locked" in download mode. Also, if you go to Settings->About Phone->Status, you will notice "Installment payments" section marked as "Outstanding".
2. It is said that "RMM State: Prenormal" automatically goes away if you keep the phone up for 168 hours without rebooting. I do NOT know, if "RMM State: Locked" goes away automatically or not, but I doubt it.
3. Since the RMM state is locked, custom binaries still cannot be flashed for rooting.
4. For TWRP, I got error "custom binary(RECOVERY) Blocked due to remaining installment balance"
5. For Root kernel, I got "custom binary(BOOT) Blocked due to remaining installment balance"
6. Secure Folder could not be setup. I kept getting a KNOX related error but do not remember its text now.
7. I tried to backup the PERSISTENT partition but got Permission Denied error because I did not have root.
8. The command "dd if=/dev/block/platform/11120000.ufs/by-name/PERSISTENT of=/sdcard/PERSISTENT.img" failed.
9. The command "dd if=/dev/block/sda13 of=/sdcard/PERSISTENT.img" failed.
10. I tried to format the PERSISTENT partition but got Permission Denied error because I did not have root.
11. The command "dd if=/dev/zero of=/dev/block/platform/11120000.ufs/by-name/PERSISTENT" failed.
12. The command "dd if=/dev/zero of=/dev/block/sda13" failed.
13. KNOX was not tripped so phone warranty was not void.

The phone had become largely usable so I gave up at this point. If you make more progress, don't forget to share with the community. I'm not an Android Developer and also do not have access to any Flasher Boxes. It took me quite a while to figure this out and to write this tutorial, so do give me credit if I have helped you. Good luck.

Lo maximo bro saludos tengo uno exactamente igual..

Enviado desde mi SM-A320Y mediante Tapatalk

[jsilvabr]

Originally Posted by ukrhaker

At note 8 n950f after this procedure the phone does not turn on, hangs on the screen saver samsung. What are the ideas of what can be done?

I did ALL PROCEDURE and also gets frozen on the SAMSUNG screen that in note 8 found some solutio

[BillA]

Originally Posted by jsilvabr

I did ALL PROCEDURE and also gets frozen on the SAMSUNG screen that in note 8 found some solutio

Re-flash with original stock firmware.
Not the "U1" version but the one your carrier shipped it with.
At least it will boot again.

[BillA]

Originally Posted by USflash

Still can’t unlock it

You have to leave the phone turned on for at least 168 hours (over 7 days) continuously without touching at all, and then the OEM-Unlock option will become visible again. Not sure, but you might also have an MDM (corporate lock) which is really difficult to remove.

Here's some more info about the new RMM lock.
G955F RMM State locked, asking password - Page 3 - GSM-Forum

[adnastar]

i dont get any device with this lock before but has anyone tried rebranding the device
full customization to see if it removes rmm lock
FLASH COMBINATION
FLASH HOME CSC
*#243203855#
SELECT A DIFFERENT PRECONFIG CSC
THEN FLASH STOCK

[gsm_service4u]

Originally Posted by adnastar

i dont get any device with this lock before but has anyone tried rebranding the device
full customization to see if it removes rmm lock
FLASH COMBINATION
FLASH HOME CSC
*#243203855#
SELECT A DIFFERENT PRECONFIG CSC
THEN FLASH STOCK

Someone should try this, but I doubt it will remove RMM, only reset it back to prenormal or reset the clock


On this topic
Does anyone have adb commands which you can use to turn on oem unlock from the adb shell
Would be nice to have, also adb command which reset the phone from settings

[BillA]

Originally Posted by gsm_service4u

Someone should try this, but I doubt it will remove RMM, only reset it back to prenormal or reset the clock
On this topic
Does anyone have adb commands which you can use to turn on oem unlock from the adb shell?
Would be nice to have, also adb command which reset the phone from settings.

Unfortunately there's no adb command to turn on oem unlock, it's a system setting's call, therefore it can only be activated manually through the Developer Option's menu. You could try installing this reset app through file manager to do a forced factory reset (as long as you have access to the main screen).
https://www.androidfilehost.com/?fid=818070582850492463

Originally Posted by adnastar

i dont get any device with this lock before but has anyone tried rebranding the device
full customization to see if it removes rmm lock
FLASH COMBINATION
FLASH HOME CSC
*#243203855#
SELECT A DIFFERENT PRECONFIG CSC
THEN FLASH STOCK

Changing CSC unfortunately does not remove MDM or RMM.
You have to disable both manually.

Originally Posted by DJNJ

What are my options if my RMM State is Prenormal?
Brand new phone, bought from Samsung.
I just want to install TWRP.
I did the 7 day wait trick without rebooting, completed 168 hours uptime, but the RMM State line didn't dissappear from my download mode. It was showing prenormal.
OEM Unlock is visible and off
FRP Lock is also off.
Still Odin won't allow to flash TWRP, shows the remaining installment balance error.
Any help is much appreciated!

Looks like you have both RMM and MDM.
MDM is Mobile Device Manager which causes to show the message "Remaining Installment Balance" by a rental company's app such as RAC or PayJoy, so you've got a double whammy right there. You will have to disable both RMM and MDM manually before being able to continue to flashing.