Database Info

SM-T235 / SM-T235Y Tab 4 7" - ROOTED - TWRP Recovery 2.8.7 for SM-T235/235Y (LTE)

SM-T235 / SM-T235Y Tab 4 7" - ROOTED - TWRP Recovery 2.8.7 for SM-T235/235Y (LTE)
UPDATED 7/30/2015 with OFFICIAL TWRP 2.8.7 for Galaxy Tab 4.7.0 SM-T235(Y) DEVICES​As with other TWRP's for newer Samsung devices, you need to uncheck auto-reboot and F.Reset time in Odin so you can manually shut down the device and boot into recovery the first time after flashing the custom recovery. If you don't boot into the custom recovery immediately after flashing it to the device, then the OS will overwrite it with the factory recovery and you'll need to start over.
DISCLAIMER :
While we all love to flash new things, You and You alone can choose or choose not to flash this custom recovery.
I am not liable for any of the following : Bricks, Soft Bricks, Meltdowns, loss of data, or damage to your device.
DISCLAIMER #2:
THIS RECOVERY WILL TRIP YOUR KNOX COUNTER - YOUR WARRANTY WILL BE VOID.
THIS RECOVERY IS ONLY FOR SM-T235 and SM-T235Y Tab 4 7" LTE Devices
INSTRUCTIONS​1). Download Odin3v1.85.zip, recovery.tar.md5.zip, and UPDATE-SuperSU-v2.46.zip - all attached
2). Unzip Odin3v1.85.zip placing the extracted folder somewhere on your PC you can find and execute Odin3 from later.
3). Store UPDATE-SuperSU-v2.46.zip somewhere on your SM-T235's external SD storage where you can find it from TWRP later.
4). Unzip recovery.tar.md5.zip placing the extracted file recovery.tar.md5 somewhere on your PC you can find it from Odin3 later.
5). Put SM-T235 tablet in Download Mode (Power Button+Volume Down+Home Button)
6). Flash recovery.tar.md5 using Odin3 v1.85 - use PDA/AP button in Odin - UNCHECK Auto-Reboot and F.Reset Time
7). When flashing is completed you will see RESET displayed in Odin3.
8). Unplug your SM-T235/SM-T235Y from the PC and press (Power Button+Volume Down+Home Button) to initiate a restart/reboot - Don't release your fingers from the buttons.
9). IMPORTANT: AS SOON AS THE DEVICE POWERS DOWN (screen goes blank) MOVE YOUR FINGER FROM THE VOLUME DOWN BUTTON TO THE VOLUME UP BUTTON WHILE STILL PRESSING THE POWER BUTTON+HOME BUTTON.
10). IMPORTANT: AS SOON AS THE SAMSUNG SM-T235 LOGO APPEARS (White Letters) RELEASE YOUR FINGER FROM THE POWER BUTTON WHILE CONTINUING TO PRESS VOLUME UP+HOME BUTTON (If the animated Samsung Logo appears, then you missed Recovery mode and will need to start the entire process over from the beginning.
11). IMPORTANT: If you timed your finger pressing and releasing properly, you should now SEE the blue TEAMWIN splash screen which means you are entering TWRP recovery.
12). Once in TWRP Recovery, you will see a button that says Install. Tap on it.
13). Find UPDATE-SuperSU-v2.46.zip where you previously stored it on your external SD card and install/flash it to your SM-T235/235Y using TWRP.
14). Once installation of UPDATE-SuperSU-v2.46.zip is completed, you can proceed to reboot your SM-T235/T235Y from the TWRP main menu.
15). After the device finishes booting up, your Galaxy Tab 4 7.0" SM-T235/T235Y will be rooted.
16.) Download and run RootChecker to verify root.
CREDITS:
hennymcc - [T235][ROM][5.1.1][LMY48G] CyanogenMod 12.1 for T235(Y) [Alpha 12/07/2015]
RVR - TWRP 2.8.1 for the Galaxy S5 Mini (G800F)
Chainfire - UPDATE-SuperSU-v2.46
A.S._id - Odin3 ROM Editor
A.S._Dev - android_img_repack_tools​

My friends,
I still could use some radio help. ...
TTB
SM-T235 Tab 4 7" LTE ROOTED - TWRP 2.8.1 for the SM-T235/T235Y Tab 4 7" LTE
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Reserved

TopTongueBarry said:
Also reserved
IT IS SO NEARLY IMPOSSIBLE TO WORK ON ANY THREAD OR POSTING ON THIS SITE. I LOST EVERYTHING I I WAS TRYINGTO UPDATE THIS THREAD WITH D/L LINKS, BUT THE VIDEO ADVERTISEMENTS JUST KILL IE. REPEATEDLY. WHY SO MANY VIDEO ADS, IMPOSSIBLE TO ENJOY AN XDA EXPERIENCE BECAUSE THE HUGE VIDEO ADS JUST CRAWL MY SYSTEM.
THERE WOULD HAVE BEEN A T235 RECOVERY ROOT HERE TODAY BUT THE ADS KILLED MY SESSIONS. I WROTE INSTRUCTIONS AND HAD EVERYTHING READY. THE LONGER IT TAKES TO POST A TOPIC AND INSTRUCTIONS THE MORE BEFUDDLED UP IE GETS UNTIL IT CRASHES.
OH WELL I CANNOT SPEND ANY MORE TIME TODAY HERE. HAVE TO GET BACK TO WORK. SO MUCH FOR GIVING YOU THE D/L's DURING LUNCH BREAK, BUT MAYBE TONIGHT, MAYBE NOT. IM TOO FRUSTRATED AND UPSET THAT I LOST ALL THAT WRITING AND WORK HERE TODAY. WE'LL SEE HOW QUICKLY I GET OVER IT , THEN YOU'LL GET YOUR RECOVERY ROOT.
Click to expand...
Click to collapse
That really blows, I feel your pain. I use chrome on my desktop with the adblock extension (I think it's even available for IE now) and I find the -- XDA 2013 theme for the website is much more aesthetically appealing and easier to navigate

It works! Changing of buttons is kinda tricky though, but its all good.. Thanks alot! :good:

thisisapoorusernamechoice said:
That really blows, I feel your pain. I use chrome on my desktop with the adblock extension (I think it's even available for IE now) and I find the -- XDA 2013 theme for the website is much more aesthetically appealing and easier to navigate
Click to expand...
Click to collapse
Thanks for the tip. I added the adblock plug in. My XDA experience is much improved. Thanks!
TTB

Jay018 said:
It works! Changing of buttons is kinda tricky though, but its all good.. Thanks alot! :good:
Click to expand...
Click to collapse
Confirming what you posted in the old thread, that your device is a SM-T235Y ?
Glad it works.
The T235Y has different factory ROMS on sammobile than the T235. Differences include CSC groupings, and configured radio bands, but the kernel and the partitions are the same as the T235. I suspect that's why this recovery works for the T235Y too.
- Speaking of which, can anybody point me in the direction of a way to get past the hurdles Samsung has added to block the ability to reconfigure LTE radio bands
- If we need to change the CSC's or CSC group to be able to enable LTE Bands 4 and 17, well, Sammy's making that tough to do too.
- Wondering if I can flash the modem firmware from the S5 Mini on the Tab 4 7" LTE using TWRP?
- Then wondering if bands 4 and 17 would be available after flashing since the CSC's play such a role in which radio band's get configured on each device.
Any help with the radio would be greatly appreciated.
TTB

TopTongueBarry said:
Confirming what you posted in the old thread, that your device is a SM-T235Y ?
Glad it works.
The T235Y has different factory ROMS on sammobile than the T235. Differences include CSC groupings, and configured radio bands, but the kernel and the partitions are the same as the T235. I suspect that's why this recovery works for the T235Y too.
Click to expand...
Click to collapse
Yes it's T235Y.. You can add T235Y in your title so other users will know.. Yes it has different ROM so I hesitated at first. Just need a couple of beer to do it, lol. Thanks a lot for this recovery. :good:

My friend....Congratulations...I have tried any method known to Google to root this tablet. Yours was the only one that worked. I have been waiting for this moment from November so thank you for making my day.

Success!!
I played fingers just like over my guitar fingerboard, haha! Then, suddenly, I was in face of TWRP face!:laugh:
First of all: install SD fix!
Infinity thanks to TopTongueBarry and his brilliant idea!:good:

aftnoon2 said:
Success!!
I played fingers just like over my guitar fingerboard, haha! Then, suddenly, I was in face of TWRP face!:laugh:
First of all: install SD fix!
Infinity thanks to TopTongueBarry and his brilliant idea!:good:
Click to expand...
Click to collapse
SD gets fixed if you flash a newer factory ROM than the 5/22 NE8 version. You will need to reinstall TWRP and re root.
TWRP installation and root tested and found to be working no matter which ROM you are running, including the latest version, NJ3
TTB
P.S. After rooting, KNOX can be disabled using ES Task Manager and it doesn't respawn, remains disabled. I'm toying with this in an attempt to get service mode changes to the available LTE bands to stick.
P.S.S ... I'll be releasing either ALPHA 2 or BETA 1 with the Slide to install SuperSU fixed and the missing advanced menu items added later this week.

TopTongueBarry said:
SD gets fixed if you flash a newer factory ROM than the 5/22 NE8 version. You will need to reinstall TWRP and re root.
TWRP installation and root tested and found to be working no matter which ROM you are running, including the latest version, NJ3
TTB
P.S. After rooting, KNOX can be disabled using ES Task Manager and it doesn't respawn, remains disabled. I'm toying with this in an attempt to get service mode changes to the available LTE bands to stick.
P.S.S ... I'll be releasing either ALPHA 2 or BETA 1 with the Slide to install SuperSU fixed and the missing advanced menu items added later this week.
Click to expand...
Click to collapse
Just don't care, TTB! I was ALREADY on NJ3!
Thanks for the Es explorer Knox idea, but, do you mean freezing Knox? I don't understand, sorry ...
And many thanks for keep the job over TWRP :good:

this is awesome i bought a couple 235y of my step dads friend for 100 bucks a pop thinking i got a great deal and and I was gonna put vanilla on it and blah blah came to xda to see there was no support..... decided to come on today see if there was anything and see this...
so amped..
---------- Post added at 10:51 PM ---------- Previous post was at 10:11 PM ----------
any custom rome we can flash or am i assuming no because deltas, I'm gonna try a couple things.

David111jr said:
this is awesome i bought a couple 235y of my step dads friend for 100 bucks a pop thinking i got a great deal and and I was gonna put vanilla on it and blah blah came to xda to see there was no support..... decided to come on today see if there was anything and see this...
so amped..
---------- Post added at 10:51 PM ---------- Previous post was at 10:11 PM ----------
any custom rome we can flash or am i assuming no because deltas, I'm gonna try a couple things.
Click to expand...
Click to collapse
No Custom ROMS yet, but since we now have a working recovery and root, there will hopefully be some soon..
I'm beating my head against the wall trying to get LTE bands 4 and 17 added. The factory firmware is quite unforgiving. A custom ROM would sure make the effort easier. Someone PLEEZE ......
Regarding freezing Knox, yes that's what I meant, and it works, but I've managed to wipe the CSC during my efforts to add LTE bands. Don't know if that's a good or bad thing at this point.
Apparently the Samsung USB drivers do have a diagnostic mode driver for Marvel chipsets. After much effort, I have it installed on my Win 8 machine, and the driver switches dynamically when switching from PDA to MODEM in the Service Mode menus. Problem is, its not a serial driver it is a USB/QC driver and QPST version 2.7.411 still doesn't recognize it. Need to find a way to get QPST to recognize it.
Can't do the NV ram edit needed to add LTE bands without diagnostics mode.
TTB

It works. SM-T235 LTE
Thanks!

I think my t235y will never be rooted, you are awesome bro

Thanks for your efforts, TTB!
Now a question : can we make a Nandroid bckp on the External SD?
I would to make one, but, apparently, the bckp goes to Internal, where I have no place ...
Is this intrinsic of TWRP or a later version can change this?

aftnoon2 said:
Thanks for your efforts, TTB!
Now a question : can we make a Nandroid bckp on the External SD?
I would to make one, but, apparently, the bckp goes to Internal, where I have no place ...
Is this intrinsic of TWRP or a later version can change this?
Click to expand...
Click to collapse
Check the T230 recovery/root threads. I believe (not 100% certain though) I saw that someone has created a fix/work-around to allow switching internal SD and external SD for this.

thienlong0193 said:
I think my t235y will never be rooted, you are awesome bro
Click to expand...
Click to collapse
What do you mean you think it will never be rooted? This works on the T235 and the T235Y.

TopTongueBarry said:
What do you mean you think it will never be rooted? This works on the T235 and the T235Y.
Click to expand...
Click to collapse
sorry my bad english, i mean i've been waiting for so long to root my tab :laugh: thank you a lot :x

(XT1575) Moto X Pure February 24.201.3. update flashable modem

Here's a flashable zip of the newest modem for Moto x pure xt1575. I recommend to backup efs before flashing...figured id share for those interested
Flash at your own risk:
...remember to make a efs backup first...
https://www.androidfilehost.com/?fid=24438995911969212
Thanks to @Spasticdroid for images
And whoever made the flashable zip for the intial MM update

Google~Android said:
Here's a flashable zip of the newest modem for Moto x pure xt1575. I recommend to backup efs before flashing...figured id share for those interested
Flash at your own risk:
https://www.androidfilehost.com/?fid=24438995911969212
Thanks to @Spasticdroid for images
And whoever made the flashable zip for the intial MM update
Click to expand...
Click to collapse
Flashed with TWRP 3.0.0 and got no service/signal of any kind. Only wifi. Flashed an old modem zip I had and still did not fix the problem. Restoring the EFS backup I made prior to the initial flash returned everything to normal. Anything I did wrong or didn't understand?
Running 2-26 AOKP build

crowmallet said:
Flashed with TWRP 3.0.0 and got no service/signal of any kind. Only wifi. Flashed an old modem zip I had and still did not fix the problem. Restoring the EFS backup I made prior to the initial flash returned everything to normal. Anything I did wrong or didn't understand?
Running 2-26 AOKP build
Click to expand...
Click to collapse
Same issue here.

crowmallet said:
Flashed with TWRP 3.0.0 and got no service/signal of any kind. Only wifi. Flashed an old modem zip I had and still did not fix the problem. Restoring the EFS backup I made prior to the initial flash returned everything to normal. Anything I did wrong or didn't understand?
Running 2-26 AOKP build
Click to expand...
Click to collapse
defvayne said:
Same issue here.
Click to expand...
Click to collapse
Idk... Maybethe rpm images r needed... I flashed it right before i uploaded it... It took about 20 seconds to find my imei and network and then since then all go.... I even proir had an issue wit my fone randomly showong i had. No sim inserted and since i flashed the new update and then flashed aosp roms i habe on the problem twice... So idk what it is.. Oh well that why the first thing a fone should do after twrp is a safely Kept efs backup
Edit... Just flashed another rom along wit the modem just to test and everything worked great...

Google~Android said:
Here's a flashable zip of the newest modem for Moto x pure xt1575. I recommend to backup efs before flashing...figured id share for those interested
Flash at your own risk:
...remember to make a efs backup first...
https://www.androidfilehost.com/?fid=24438995911969212
Thanks to @Spasticdroid for images
And whoever made the flashable zip for the intial MM update
Click to expand...
Click to collapse
Something is not right here.
File sizes are completely different compared to the recovery images from motorola. See pics below:
OP's file contents:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Contents from the motorola update:
Difference in unpacked image size. My guess is the OP's images are of the entire partition while the motorola ones are of just the file contents. Still, some folks having identical issues warrants further research.

gpz1100 said:
Something is not right here.
File sizes are completely different compared to the recovery images from motorola. See pics below:
OP's file contents:
Contents from the motorola update:
Difference in unpacked image size. My guess is the OP's images are of the entire partition while the motorola ones are of just the file contents. Still, some folks having identical issues warrants further research.
Click to expand...
Click to collapse
I can promise u there were pulled from the zip in the general section of the February update....extracted the previous modem band 12 fix zip and replace the 2 files... That all i did

gpz1100 said:
Something is not right here.
File sizes are completely different compared to the recovery images from motorola. See pics below:
OP's file contents:
Contents from the motorola update:
Difference in unpacked image size. My guess is the OP's images are of the entire partition while the motorola ones are of just the file contents. Still, some folks having identical issues warrants further research.
Click to expand...
Click to collapse
Could you share link to where you got the stock February firmware

Guys, PLEASE STOP THE UNNECESSARY QUOTING!!! Surely it's possible to reply without automatically quoting or edit the quote out.
I got the firmware by requesting it through motorola. I believe there's a thread on here that's mirroring it but don't have the link. Look in the general or Q&A subsections. Should be on the first or second page.

Following
Sent from my XT1575 using Tapatalk

gpz1100 said:
I got the firmware by requesting it through motorola. I believe there's a thread on here that's mirroring it but don't have the link. Look in the general or Q&A subsections. Should be on the first or second page.
Click to expand...
Click to collapse
That is odd, because i requested the link from Motorola as well and my folder sent from them does not Say Feb 2016 in the title anywhere.
The contents are also diff file sizes as well.
I looked at all the linked mirrors and they all point to the one i have.
look at this pic, yours is on the left, mine on the right.

^^I added the feb 2016 to the name to better distinguish between all the firmware files. After a while it gets hard to figure out which one is what.
Yours looks nearly identical. The difference is you're looking at explorer which shows file size in terms of KB, mine shows actual byte size. Do a properties on each file and you'll see the actual size too. Windows 101.

gpz1100 said:
^^I added the feb 2016 to the name to better distinguish between all the firmware files. After a while it gets hard to figure out which one is what.
Yours looks nearly identical. The difference is you're looking at explorer which shows file size in terms of KB, mine shows actual byte size. Do a properties on each file and you'll see the actual size too. Windows 101.
Click to expand...
Click to collapse
Thanks for the window's 101, did not know that..
But it looks like that's your answer too.. The build that you have is identical to mine. Meaning that we are on the November 1 2015 security patch. OP uploaded the differences from the new February 1 2016 update.

cangri87 said:
Thanks for the window's 101, did not know that..
But it looks like that's your answer too.. The build that you have is identical to mine. Meaning that we are on the November 1 2015 security patch. OP uploaded the differences from the new February 1 2016 update.
Click to expand...
Click to collapse
That's the weird part, files within the archive are dated 2/1/2016. Even so, baseband files do not grow that much in size, especially when they still return the same version number.
Stranger yet (I mentioned it in the feb update thread) is if you flash the current motorola firmware (MPH24.49-18_18), the phone refuses to take the ota to the newest firmware. OTOH, if you flash the original nov firmware 24.49-18, then the phone updates to the feb build without any issues. I've tested all these different firmwares to arrive at the conclusions above.
A binary compare between the original MM baseband (from the november firmware) and the current one (firmware on the motorola site) reveals many differences. There must be some undocumented changes.
My suggested upgrade path is real simple;
1) Flash the original 24.49-18 firmware (not the one that's on motorola now). This is available in the general or developer's thread. filename: CLARK_RETUS_6.0_MPH24.49-18_cid9_subsidy-DEFAULT_CFC.xml.zip
2) Let it boot then perform the system update - this will bring you to the feb build of everything including the baseband
3) Flash whatever rom you want. Don't touch the baseband
Unless there are worthwhile changes, I generally don't touch the baseband. Usually don't touch the firmware either.

non developer build
Hi, if I bought the xt1575 from best buy and flashed the latest marshmallow would it brick my radios and wifi? And if not, where can I find the latest firmware, I tried one from motorola, and lost my radio, comming from 5.1
gpz1100 said:
That's the weird part, files within the archive are dated 2/1/2016. Even so, baseband files do not grow that much in size, especially when they still return the same version number.
Stranger yet (I mentioned it in the feb update thread) is if you flash the current motorola firmware (MPH24.49-18_18), the phone refuses to take the ota to the newest firmware. OTOH, if you flash the original nov firmware 24.49-18, then the phone updates to the feb build without any issues. I've tested all these different firmwares to arrive at the conclusions above.
A binary compare between the original MM baseband (from the november firmware) and the current one (firmware on the motorola site) reveals many differences. There must be some undocumented changes.
My suggested upgrade path is real simple;
1) Flash the original 24.49-18 firmware (not the one that's on motorola now). This is available in the general or developer's thread. filename: CLARK_RETUS_6.0_MPH24.49-18_cid9_subsidy-DEFAULT_CFC.xml.zip
2) Let it boot then perform the system update - this will bring you to the feb build of everything including the baseband
3) Flash whatever rom you want. Don't touch the baseband
Unless there are worthwhile changes, I generally don't touch the baseband. Usually don't touch the firmware either.
Click to expand...
Click to collapse

gigawatt said:
Hi, if I bought the xt1575 from best buy and flashed the latest marshmallow would it brick my radios and wifi? And if not, where can I find the latest firmware, I tried one from motorola, and lost my radio, comming from 5.1
Click to expand...
Click to collapse
If you read everything (including filenames) carefully and were using the correct firmware, (in this case, NOT 1572 which is the Style and not Pure), you wouldn't be losing any radio, unless you were downgrading, in which you'd just have to manually flash the radios again via fastboot after downgrading. Use search for that info.
Anything else you did besides flashing the correct firmware, and not explaining in your posts more on what you did (such as rooting) is on you. Put more details into your post.
There's a sticky thread under Android Development with a collection of firmware for both Pure and Style.
BTW, I saw your other thread. I'm not sure what you were reading, but there is no "developer edition" of this phone, nor firmware.

Has anyone measured any improvement with the newer modem file? I like to use the latest modem when possible.

gigawatt said:
Hi, if I bought the xt1575 from best buy and flashed the latest marshmallow would it brick my radios and wifi? And if not, where can I find the latest firmware, I tried one from motorola, and lost my radio, comming from 5.1
Click to expand...
Click to collapse
You can't "brick" your radios by flashing anything posted here. You can disable them however which is easily fixed by flashing modem or kernel or su depending on the situation.

Anyone been able to solve the problem on this flashable modem file? When I try to flash it, it fails. Currently I was stuck on "roaming indicator on" while on MM and upgraded my custom rom to Nougat (Dirty Unicorn) thinking it would fix it, but it didn't. I tried flashing the MM modem zip, roaming indicator is gone, but I seem to have lost my radio.

modem
Holymsophy said:
Anyone been able to solve the problem on this flashable modem file? When I try to flash it, it fails. Currently I was stuck on "roaming indicator on" while on MM and upgraded my custom rom to Nougat (Dirty Unicorn) thinking it would fix it, but it didn't. I tried flashing the MM modem zip, roaming indicator is gone, but I seem to have lost my radio.
Click to expand...
Click to collapse
how do i tell if my modem is still nougat modem if im back to marshmallow what is nougat radio number or version?

Sherrillface said:
how do i tell if my modem is still nougat modem if im back to marshmallow what is nougat radio number or version?
Click to expand...
Click to collapse
Here is a screenshot from my phone that is running stock Nougat. It shows the Baseband version which is the radio number.

New Update - QC2

According to the Verizon Galaxy S5 Update Page:
This software update provides the latest Android™ security patches, fixes an email issue and updates the Amazon Shopping app.
Email update:
Fixes an issue that prevented Outlook® 2007 and 2003 users from accessing and downloading email attachments.
Click to expand...
Click to collapse
Please note that if you happen to play Pokemon GO or any game which "GPS Spoofers" take advantage of, the March Security Patch, and this update will prevent GPS Spoofing.
Also, I'm not entirely sure yet as to whether the Samsung Patch for Qualcomm Galaxy S5 bootloaders included in the March Security Patch will affect the ability to have a Developer bootloader anymore:
SVE-2016-7930: Multiple Buffer Overflow in Qualcomm Bootloader
Severity: Critical
Affected versions: Galaxy S5 with Qualcomm AP chipset
Reported on: December 20, 2016
Disclosure status: Privately disclosed.
A buffer overflow vulnerability exist in Qualcomm bootloader.
The patch prevents buffer overflow by removing the problematic source code.
Click to expand...
Click to collapse
I, personally, am not willing to test this, but if anyone does, please post your results. I'll upload an aboot free (Dev Friendly) firmware as soon as possible in case anyone wants to test it.
I'm currently in the process of downloading/uploading the Odin firmwares right now. I'll update this post when they are uploaded.
EDIT:
Stock No-Wipe FW. Will remove Developer Status Bootloader: G900VVRU2DQC2_G900VVZW2DQC2_G900VVRU2DQC2_HOME.tar.md5.zip
Developer Bootloader Friendly:
G900VVRU2DQC2_G900VVZW2DQC2_G900VVRU2DQC2_HOME_No_Aboot.tar.md5.zip

If it breaks something that I warned about, please reply.
If it breaks something that I didn't warn or know about, please share with everyone else.

I'm guessing no replies and no ROMs based on QC2 means noone has tested it yet.
I'm going to flash the aboot free version to one of my CID 15 S5's later tonight so I'll reply with results.

I'm gonna try it out when I get a chance this week. Thanks!

Has anybody tried this?

robbyoconnor said:
Has anybody tried this?
Click to expand...
Click to collapse
Not yet I'm gonna download this once I get to a pc definitely
Sent from my SM-G900V using Tapatalk

Kastro1784 said:
Not yet I'm gonna download this once I get to a pc definitely
Click to expand...
Click to collapse
You can use Flaahfire by the way.

Download /installed last night.Havent had time to dig around. Precursor look has only shown latest Android security updates.

Dudash said:
I'm going to flash the aboot free version to one of my CID 15 S5's later tonight so I'll reply with results.
Click to expand...
Click to collapse
How we looking, captain?

I recently was pushed the QC2 update with the March 2017 security package. I have noticed a significant decline in performance and battery life. Anyone in the same boat?
It seems like they have pushed a security updated every other month or so for the last 6 months. It is very irritating. I want to go back to root but it is too much of a hassle to figure it out at this point. I feel like they are deliberately doing these updates to make the S5 run worse and feel more outdated so you are more inclined to go buy a new one. Really sick of the whole game that is the telecom industry.
I am going to try doing a factory reset (very annoying) and see if that helps. Hopefully I can hold out long enough for the Pixel 2.

@Dudash QD1 is up, can you upload it to AFH. thanks in advance.

Noooooo! I flashed the Dev friendly QC2 modem and it seems to have killed my dev bootloader and wiped my phone!
I'll keep messing around and see if it can't be remedied. I could just punch myself for being so ambitious, though.
Edit 1: It was taking forever on the Verizon logo, so I pulled the battery and rebooted to recovery. It wiped TWRP and put in stock. I booted to Download Mode, and it still reads MODE: Developer (which I hope to God means my Dev bootloader is retained).
Edit 2: TWRP sucessfully re-flashed. The "Custom" with unlocked lock icon has reappeared on the boot screen, along with the yellow text at the top (so clearly, I was wrong about losing Dev status. Whew! I just freaked out when I saw a plain boot screen and the dreaded Verizon logo :silly. My installation of Lineage OS is clearly gone, but, peeking through TWRP's file manager appears to indicate my media data (photos, downloads, etc.) may yet have survived. I'll flash Lineage and GApps and see what happens.
Edit 3: Lineage OS booted successfully (made easier with the help of an SD card-- hooray for those things, amirite?), with QC2 baseband intact! Hooray! And my downloads and pictures and everything survived too.
Lesson: Always make a nandroid backup when doing this sort of thing! It takes a while, and it's morbidly annoying, but had I done it, I probably wouldn't've had to start from scratch. But hey, got the new baseband, and still running Lineage, so I call this a win. Cheers, everyone! And thanks to OP for posting updates!
Follow-up: Since it doesn't seem like we can flash only the new basebands by themselves, I've found a tactic that does the trick for those of us on not-stock ROMs. Boot into TWRP and make a backup of Boot, System, and Data (notice there's a Modem option-- leave it unchecked). I imagine it's best to put the backup image on an SD card. Then Odin the dev-friendly firmware update (I used the no-wipe option). Let the phone restart, then Odin the most recent TWRP back on there. Boot into TWRP, do a Factory Reset Wipe, and restore the backup you made. Takes a little while, but it does leave you with your phone as it was, but with the new baseband. :victory:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

mohammad.afaneh said:
@Dudash QD1 is up, can you upload it to AFH. thanks in advance.
Click to expand...
Click to collapse
In the process of uploading right now.

Dudash said:
In the process of uploading right now.
Click to expand...
Click to collapse
??? thanks

J-Lindo said:
How we looking, captain?
Click to expand...
Click to collapse
I totally missed this reply. I flashed QC2 onto one of my S5's and it remained a Dev Edition. Then earlier today I flashed QD1 onto my other S5 and it remained a Dev Edition as well. Faking GPS doesnt work on either anymore but they keep Dev status.

Dudash said:
I totally missed this reply. I flashed QC2 onto one of my S5's and it remained a Dev Edition. Then earlier today I flashed QD1 onto my other S5 and it remained a Dev Edition as well. Faking GPS doesnt work on either anymore but they keep Dev status.
Click to expand...
Click to collapse
No problem! I'm sure you've already seen the results of my first (embarrassingly n00bish) independent baseband flash :laugh:
I appreciate the response, though. Fortunately, I'm not into GPS spoofing, so this isn't an issue for me. When you say you flashed QC2 and QD1, do you mean strictly the basebands without the bootloaders, or did you flash the entire updates and still retain Dev status?

J-Lindo said:
No problem! I'm sure you've already seen the results of my first (embarrassingly n00bish) independent baseband flash :laugh:
I appreciate the response, though. Fortunately, I'm not into GPS spoofing, so this isn't an issue for me. When you say you flashed QC2 and QD1, do you mean strictly the basebands without the bootloaders, or did you flash the entire updates and still retain Dev status?
Click to expand...
Click to collapse
I flashed the entire firmware minus the aboot.

Flashing Firmware: A Simple Guide

When it comes to flashing firmware for the XZ Premium, I know there is a plethora of information scattered through many threads in this section. Quite frankly, I was a little overwhelmed with the whole flashing process, and, despite everyone's best efforts, was totally lost. I just wanted to flash my USA XZ Premium to the Central Europe FW to enable the fingerprint reader, but I didn't want to alter the radios, etc like in the other thread that describes the process.
So, after a bit of trial and error, I decided to put together a simple guide that I hope is easy for those with a little less "flashing" experience. I'd like to point out that none of this information is my own; I'm simply compiling it in a way in which I believe will be helpful. This post is only possible because of all the people who have contributed in the various flashing threads thus far, so many thanks to all of them. Also, I know it's a touchy subject around these parts, but I wanted to give a shout out to the developer of Newflasher -- without his tool, we all still may not have method to flash our XZPs. Thank you, sir.
Anyway:
1. Find, download and install/extract Newflasher, XperiFirm, Flashtool and the official Xperia Companion application.
2. XperiFirm: download whichever variant of the FW you’d like to load. Be sure you are choosing the correct version of your hardware.
3. Flashtool: go to the application folder, then go to the drivers folder. Run this app, and check the boxes next to Flashmode Drivers and Fastboot drivers. You will need these installed to avoid any possible connection issues with Newflasher.
4. Open the folder which contains Newflasher so you can view all of the contents. Do the same with the firmware folder that you now have which was downloaded from XperiFirm (Ex. G8142_Customized CE1).
5. Copy all of the .sin files, as well as the partition and boot folders, from the firmware folder over to the Newflasher folder. Create a new folder name "partition," and extract the existing partition folders files (that you copied from the firmware folder) in to the new partition folder.
6. Power down your phone and wait 5 seconds. Hold the volume down button with the device powered off, and plug your device into your PC.
7. Run Newflasher.exe. You should now start to see the application working (this process took about 5-10 minutes for me). It will tell you when you can disconnect.
8. Open the Xperia Companion application, and, following the on-screen instructions, do a Software Repair on your device.
9. Start your device like normal, and you should have your new software loaded!
Thanks again to all who have contributed to this process!

thanks just flashed mine from Three over to the UK customised
working great

Thanks for the guide. But someone can make a YouTube video how to flashing xzp with newflasher please! Cant find one there ty.
Sent from my G8141 using Tapatalk

Question
If I flash my phone ( details in screenshot) will it remove demo mode application that installed in it? Retail demo mode.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Thanks in advance. Don't be hard on me I am new to this. :fingers-crossed:

For those left still confused by the lack of detail above, here's a more visualized and well explained flashing method I found and mentioned in my XZP flashing thread a while back. Also has links to newflasher - which this one doesnt
https://forum.xda-developers.com/showpost.php?p=73176149&postcount=3

Ok it worked for me, just the step of repairing with pc companion did not work, pc companion restores firmware original telcel MX, so after flashing no longer repair with pc companion and finally worked.
Firmware flashing 45.0.A.7.120 generic Latam
Thanks for this tutorial !!! I hate the telcel personalization !!!

kinkyK said:
thanks just flashed mine from Three over to the UK customised
working great
Click to expand...
Click to collapse
After flashing what system apps were preinstalled? Im just wonderinf because I just got my XZ premium today and there seems to be a fair bit of bloat I wanna get rid of but cant with out root and dont wanna root because of drm, also because there isnt much support.

Just the standard Sony stuff really mate no operator stuff
Seems much better like

kinkyK said:
Just the standard Sony stuff really mate no operator stuff
Seems much better like
Click to expand...
Click to collapse
Did you have spotify pre installed?

RJASSI21 said:
After flashing what system apps were preinstalled? Im just wonderinf because I just got my XZ premium today and there seems to be a fair bit of bloat I wanna get rid of but cant with out root and dont wanna root because of drm, also because there isnt much support.
Click to expand...
Click to collapse
Try this tutorial. I've successfully deinstalled some system apps without root:
https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/

RJASSI21 said:
Did you have spotify pre installed?
Click to expand...
Click to collapse
Yes m8

kinkyK said:
Yes m8
Click to expand...
Click to collapse
OK thanks for the info.

If you flash the ce1 firmware to the us xzp do you retain the ability to receive ota updates? Do any problems arise from flashing international Firmware?

IS33D34DP30PL3 said:
If you flash the ce1 firmware to the us xzp do you retain the ability to receive ota updates? Do any problems arise from flashing international Firmware?
Click to expand...
Click to collapse
You'll still be able to receive OTA updates. No problems /should/ occur when flashing the international firmware. My brother has the XZP (US Variant) and I him flash a UK firmware to enable the fingerprint sensor.

IS33D34DP30PL3 said:
If you flash the ce1 firmware to the us xzp do you retain the ability to receive ota updates? Do any problems arise from flashing international Firmware?
Click to expand...
Click to collapse
CE1 seems to get FW updates later rather than sooner, so keep that in mind when flashing.

The_Newtype said:
CE1 seems to get FW updates later rather than sooner, so keep that in mind when flashing.
Click to expand...
Click to collapse
I flashed my US version with 45.0.A.5.1 when i got it. I'm yet to receive an OTA.

Guys I need help to finishing flashing my XZP
Guys maybe im doing something wrong or missing something here, please someone guide me because this is my 1st time flashing a phone.
Im trying to flash my US version XZP dual sim (G8142) to Central Europe(CE1) firmware to enable fingerprint sensor, but when I start newflasher, it wont do anything, and it just says: Optional step! Type 'y' and press enter if you need Gordon flash driver, or type 'n' to skip. This creates GordonGate.7s archive in the same dir with newflasher.exe!
and it just stays there and do nothing, what should i do? type 'y' or 'n'? i dont know what are the next steps...
Because in step #7 you said that you will see the application working (about 5-10 minutes), but in my case I dont know what im missing because when I start the program it just doesn't start doing its thing.
someone please tell what im doing wrong or if I should install that Gordon flash driver because I really wanna enable the fingerprint.

johnpgv said:
Guys maybe im doing something wrong or missing something here, please someone guide me because this is my 1st time flashing a phone.
Im trying to flash my US version XZP dual sim (G8142) to Central Europe(CE1) firmware to enable fingerprint sensor, but when I start newflasher, it wont do anything, and it just says: Optional step! Type 'y' and press enter if you need Gordon flash driver, or type 'n' to skip. This creates GordonGate.7s archive in the same dir with newflasher.exe!
and it just stays there and do nothing, what should i do? type 'y' or 'n'? i dont know what are the next steps...
Because in step #7 you said that you will see the application working (about 5-10 minutes), but in my case I dont know what im missing because when I start the program it just doesn't start doing its thing.
someone please tell what im doing wrong or if I should install that Gordon flash driver because I really wanna enable the fingerprint.
Click to expand...
Click to collapse
You need to extract the Gordon flash driver and install it manually

hi all, good to be here
thanks for tutorial, sounds good
two questions only:
the downloaded firmware (CE1) contains much more files inside as mentioned in the 5th step of the tutorial
are these files really not needed?
and
if something may go wrong and flashing will be unsuccessful, will it harm the phone? if yes, can i restore the last firmware with Xperia Companion?
thank you

help
Is there anyway possible that you could post a video of how to do it. I'm a better visual learner and I have been struggling for quite sometime now to complete the task so that I could flash my US version xz premium to the Central Europe so that I may use my fingerprint scanner.

Oneplus 8 IN2013 / IN2017 version has a floating number bar on the bottom.

Hi everyone, first post in a long time here. Just bought an unlocked Tmobile Oneplus 8 off Ebay. When it arrived the back of the phone has the model# IN2013 on the phone but there's also a sticker that says model IN2017. Everything looks fine with the phone but it has a floating number bar on the bottom. Does anyone know how to remove this floating number bar?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Why are you covering the numbers? Is it the serial or IMEI number?

Using the ebay seller's photo as my screenshots aren't showing up here with the Insert Image tool. The floating numbers are different than the IMEI and Serial # showing in Setting >> About phone >> Status

Hey! I have the same thing as you and am wondering exactly what you are wondering. The difference is I have a verizon variant and the model number is IN2019. Did you notice a strange app called NXP Device Test Application? I did a factory reset and it's still there. I'll attach pic. I'm thinking that these are demo store versions and just need to flash to stock, but would prefer to know more about them before I do it.

mateonexus4ever said:
Hey! I have the same thing as you and am wondering exactly what you are wondering. The difference is I have a verizon variant and the model number is IN2019. Did you notice a strange app called NXP Device Test Application? I did a factory reset and it's still there. I'll attach pic. I'm thinking that these are demo store versions and just need to flash to stock, but would prefer to know more about them before I do it.
Click to expand...
Click to collapse
interesting, and thanks for sharing! I'll note that flashing to stock may be a thing to try. I don't see a NXP Device Test Application in the app drawer though

AFAIK OnePlus internal ROMs display this bar showing the phone's IMEI to avoid leaks. All prototype and internal (secret_mea_X) ROMs have that line at bottom.
---------- Post added at 07:02 AM ---------- Previous post was at 07:00 AM ----------
If you're interested in backuping the ROM before you flash to stock, please do that. Also check your ROM version if it starts with secret_mea

Thanks a lot for the information. This bar isn't the IMEI though... or the serial or matching any other information that I can find in the phone.
I think I'll back up in case in flashing somerhing goes wrong or isn't compatible. Now the flashing question. Can verizon variant, which mine appears to be, be flashed? I looked at the firmware on OPO official site and only see 10.5.12.IN21AA. Can this be flashed on top of whatever I have? This I assume is the unbranded firmware.
I'm currently running 10.5.IN67CD. Software version IN2019_12_200213.
Any good HOW TO's for flashing back to stock for verizon variant?
Thanks for all the insight thus far.
lulujyc said:
AFAIK OnePlus internal ROMs display this bar showing the phone's IMEI to avoid leaks. All prototype and internal (secret_mea_X) ROMs have that line at bottom.
---------- Post added at 07:02 AM ---------- Previous post was at 07:00 AM ----------
If you're interested in backuping the ROM before you flash to stock, please do that. Also check your ROM version if it starts with secret_mea
Click to expand...
Click to collapse

mateonexus4ever said:
Thanks a lot for the information. This bar isn't the IMEI though... or the serial or matching any other information that I can find in the phone.
I think I'll back up in case in flashing somerhing goes wrong or isn't compatible. Now the flashing question. Can verizon variant, which mine appears to be, be flashed? I looked at the firmware on OPO official site and only see 10.5.12.IN21AA. Can this be flashed on top of whatever I have? This I assume is the unbranded firmware.
I'm currently running 10.5.IN67CD. Software version IN2019_12_200213.
Any good HOW TO's for flashing back to stock for verizon variant?
Thanks for all the insight thus far.
Click to expand...
Click to collapse
Sorry I'm not sure about the Verizon variant. I'm currently using the global model.

Is it possible to use this tool from https://forum.xda-developers.com/android/software/tool-tool-one-driversunlocktwrpfactory-t3358711 to flash to stock?

I was always taught to stay away from ALL IN ONE TOOLS.... and I imagine it would depend on your variant. As far as I can tell I can't flash verizon variant.
10kd said:
Is it possible to use this tool from https://forum.xda-developers.com/android/software/tool-tool-one-driversunlocktwrpfactory-t3358711 to flash to stock?
Click to expand...
Click to collapse

Any luck on trying to flash stock firmware?

Found this on the OnePlus Alpha build bug report page.
https://forums.oneplus.com/threads/alpha-build-ui-suggestions.1274484/#post-21954586

The floating number is the PCBA number. Dialer code *#888#

Okay folks, here's the solution!
The firmware zip files already have the MSM tool zipped up in it.
Make sure to download and install the OnePlus USB device drivers and install in addition to the Qualcomm drivers from the linked site
For T-Mobile
https://forum.xda-developers.com/oneplus-8/how-to/op8-unbrick-tool-to-restore-device-to-t4093043
For Global
https://forum.xda-developers.com/oneplus-8/how-to/op8-unbrick-tool-to-restore-device-to-t4085877/
No more PCB watermark. Make sure to backup any data you want to keep as this makes the phone factory fresh.

does this still work?

I've sent you a message OP, I had the same issue

supergroverthm said:
Okay folks, here's the solution!
The firmware zip files already have the MSM tool zipped up in it.
Make sure to download and install the OnePlus USB device drivers and install in addition to the Qualcomm drivers from the linked site
For T-Mobile
https://forum.xda-developers.com/oneplus-8/how-to/op8-unbrick-tool-to-restore-device-to-t4093043
For Global
https://forum.xda-developers.com/oneplus-8/how-to/op8-unbrick-tool-to-restore-device-to-t4085877/
No more PCB watermark. Make sure to backup any data you want to keep as this makes the phone factory fresh.
Click to expand...
Click to collapse
Thank you so much for this solution! I’m in the same boat and only bought this phone because I came across this post before buying.
Do you have any tips for a noob on how I can get this phone into EDL mode as per the instructions you linked? Tried via the volume buttons and via adb with no luck.
The phone screen just turns black when I try to do it via adb and it can only be turned back on by holding the volume up and power buttons. Holding the power button by itself won’t turn the phone back on.
I’m trying to do this right out of the box, haven’t even connected the phone to wifi or anything, not sure if that matters. I’m pretty new to this and have been getting more into phones lately so I thought I’d try to fix this OP 8.
Just in case, sorry for replying to such an old comment, not sure if that goes against etiquette here, I just created this account. Would appreciate any help you can offer!

Shoresy said:
Thank you so much for this solution! I’m in the same boat and only bought this phone because I came across this post before buying.
Do you have any tips for a noob on how I can get this phone into EDL mode as per the instructions you linked? Tried via the volume buttons and via adb with no luck.
The phone screen just turns black when I try to do it via adb and it can only be turned back on by holding the volume up and power buttons. Holding the power button by itself won’t turn the phone back on.
I’m trying to do this right out of the box, haven’t even connected the phone to wifi or anything, not sure if that matters. I’m pretty new to this and have been getting more into phones lately so I thought I’d try to fix this OP 8.
Just in case, sorry for replying to such an old comment, not sure if that goes against etiquette here, I just created this account. Would appreciate any help you can offer!
Click to expand...
Click to collapse
I wish I can be of more help. My phone went into EDL mode with the buttons. If I remember right, the EDL mode looked like the phone was still off and I think I had to plug it into a USB 2.0 port on my computer. Anyways, try all the different USB ports then try different computers.
Traded that OnePlus 8 for a Galaxy S21 several months ago with T-Mobile.

supergroverthm said:
I wish I can be of more help. My phone went into EDL mode with the buttons. If I remember right, the EDL mode looked like the phone was still off and I think I had to plug it into a USB 2.0 port on my computer. Anyways, try all the different USB ports then try different computers.
Traded that OnePlus 8 for a Galaxy S21 several months ago with T-Mobile.
Click to expand...
Click to collapse
Thank you for the reply! I couldn't figure out if EDL mode looked any different since the guide I saw online seemed to suggest that there would be some indicator on the screen.
I noticed that a USB 3 port wouldn't even register the phone on my PC but a USB 2 port seemed to do the trick. My other PC has malfunctioning ram but at the worst case I'll have to wait until I get that fixed.
My plan is also to trade it in, assuming I can get it to work. Thanks again!

Shoresy said:
Thank you for the reply! I couldn't figure out if EDL mode looked any different since the guide I saw online seemed to suggest that there would be some indicator on the screen.
I noticed that a USB 3 port wouldn't even register the phone on my PC but a USB 2 port seemed to do the trick. My other PC has malfunctioning ram but at the worst case I'll have to wait until I get that fixed.
My plan is also to trade it in, assuming I can get it to work. Thanks again!
Click to expand...
Click to collapse
OK...I'm an idiot, never read the end of the guide, figuring everything was in order and I wouldn't need that information until later. My phone was showing up as QHUSB_BULK instead of QDLOADER 9008 in Device Manager and for some reason the drivers I downloaded were being seen as incompatible with the phone.
After running Windows update, the drivers were successfully updated and on the very next attempt, I was able to get the phone into EDL mode and it was picked up by the MSM tool. Just figured I'd leave an update in case anyone is having the same issue and wondering how to move forward.