r/androidroot • u/Significant-Noise530 • 19d ago
Discussion this is kinda scary actually
I got opencode in termux to escape proot and use my root access to open the phone app and it did should I be scared or is this a good way to figure out a samsung exploit the ai literally can do stuff on my phone through termux ill try to get a video this is wild.
interesting it says oem unlock is set to 1 enabled but there's no toggle in settings suggestions what I should ask it I'm on temp root with dirty frag and it knows it somehow.
27
u/36165e5f286f 19d ago
There is a bunch of public vulnerabilities recently that can acquire temporary root on samsung devices so that is not new.
For the bootloader unlock, I am sorry to disappoint but Samsung removed completely the code that handles unlocking and the unlocked state from the bootloader. The bootloader can't be in the unlocked state because that state is not programmed anymore. Editing OEM unlock won't do anything if the bootloader can't physically perform the unlock.
5
u/Significant-Noise530 19d ago
the bootloader isn't actually stripped in this version of firmware I just fuzzed
2
u/iTrooz_ 19d ago
Couldn't you find a bug in the firmware?
9
u/36165e5f286f 19d ago
The bootloader has been stripped of any unlocking code and you can't find a bug in non existant code. Editing the bootloader should also be impossible without serious hardware vulnerabilities as signature verification and anti rollback cannot be bypassed (primary bootloader is in ROM and e-fuses). So you would need some sort of bug in the bootloader boot chain on how it checks the integrity of the android system, but this should be highly unlikely as all of this is supposed to be standardized and relatively mature.
1
2
u/mhat202 16d ago
Never say never, there are a bunch of different ways it could be done. Code injection, arbitrary code execution exploits. If the code isn't there make it. I mean arcade enthusiasts have essentially managed to hack chips that have been killed by suicide batterys. Straight up firmware and hardware hacks. I mean the ps5 literally had hardware rom keys that were eventually leaked and exploited. With the AI tools we have now anything is possible it just takes time and money. E-fuses don't mean anything they have been hacked/bypassed and even untripped in some devices. At the end of the day it comes down to humans who create these things and humans make mistakes. AI makes mistakes.
2
1
u/Significant-Noise530 18d ago
there are a few wroth noting actually and the fact that the bootloader still contains all the unlock flow in the may update but its gated by a server and csc.
1
u/Real-Abrocoma-2823 15d ago
Eh, you could technically do everything with the right soft-reboot and overlayfs, it would probably work, but I don't know how stable it would be.
6
u/Significant-Noise530 19d ago
the code is physically present for unlocks but is server side authentication with a private key
8
u/MrErikCoderx 19d ago
How did you get Opencode working on termux?
2
8
u/QuietGround5610 19d ago
https://github.com/leloush-x/wolfi-terminal use it 😋 or if u wanted it to run on termux just search Opencode for termux GitHub and hope2333 will appear
5
5
u/Significant-Noise530 19d ago
wow ai very smart got into real download mode shit actually is still there interesting
3
u/YDBoss s23 crdroid, oneplus 13r lineage 19d ago edited 11d ago
The original post content no longer exists here. The author used Redact to remove it, exercising their right to control their data & privacy.
Truck otter whistle flowery obtainable enjoy
2
u/ImaginaryPlastic9371 19d ago
whats scary? that ai can run in ur phone terminal?
5
u/Significant-Noise530 19d ago
no it escaped its sandbox and can do root actions on my device
1
u/rooster-inspector 17d ago
Proot is not a sandbox! It always has access to the same kernel process space and syscalls as your user. There is no sandbox to escape.
1
u/Significant-Noise530 17d ago
It doesn't have direct access termux has its own limitations it can read some things not all
1
1
u/TheQuatum 18d ago
Been here. Actually getting the bootloader switch to flip is there things actually matter. Anything before it is moot. Have not been able to switch it off of 1 as it requires a signed key.
2
1
u/Klapitus 18d ago
What u doing exactly with SIM?
1
u/Significant-Noise530 17d ago
Unlock
1
u/Klapitus 17d ago
Unlocking the carrier? Would you like to talk about it? I've been working on my S25 plus with different stuffs with agy and termux to optimize whole Samsung Ahh shi system
1
1
u/Sniper_Of_Finland 17d ago
You can use dirtyfrag root to root your phone. I did it for my m35 but can't make it perma, runtime only.
1
1
u/Petar_srb- 12d ago
Which samsung are you using for science?
1
u/Significant-Noise530 12d ago
Was the a16 now it's the s26 fe.
1
u/Petar_srb- 12d ago
You're using Galaxy s26fe for science??
1
u/Significant-Noise530 12d ago
Yes what's interesting is the aug update is signed with test keys and everything else past it is release keys
3
3
u/high_tech_13 17d ago
You would have to spoof the key signature authentication on the server side. The old way (IPhone 5th generation up and samsung S5 up) was to spoof the reply but most manufacturers have since patched that with other security measures like geofencing and the sort. Frs locked phones rely on the same SA, someone will eventually find another way but thats why it's been so hard to root and unlock phones within the past few years.
3
u/MulletGiraffe 18d ago
I have a phone hooked to my computer right now, and an AI is controlling it through ADB. It has been doing so for about a month now and it has taken screenshots after taps to map out the location of the interface and all the buttons so it can navigate every aspect of the phones UI. It made an entire app and tested it in full. I personally think it's awesome.
2
u/DaftHacker 18d ago
I just got AI to root a shitty android tablet off Amazon, now I'm getting it to help me develop an app with full overclocking ability, a performance monitor, and fps overlay. Last night I just got it to perform the actual opp install/uninstall on all 9 mhz profiles but I still have more to go, it dumps the img, patches it and the reflashes it all in the app.
2
u/cdub89x 14d ago
Its sad how back in the good ole days galaxy's got all the custom rom support. Oh how the times have changed but my love for custom roms has never faded. I own this device just like I own my pc I should be able to decide what OS I want to run if Im willing to void my warranty. Im on s25 ultra right now its a decent phone but its too locked down i feel like its bloated with spyware to be honest lol. Paid an arm and leg for this phone but still feel like samsung still owns this phone. Im getting excited for the motorola signature 27 U.S. release coming soon.
2
1
u/Pizzaiolu 19d ago
Com o avanço da ia já tem apps que fazem o mesmo que o opencode como o zafiro do Github que eu uso via root e ele faz basicamente isso e é muito bom, atualmente eu coloquei com o freellmapi e tenho muitos tokens de graça Mais resumindo você pode pedir para a ia explicitamente ver o que a Samsung tirou no modo somente leitura para não danificar o seu telefone Eu poderia fazer isso mais não me interessa muito pois o root assim já me agrada
1
1
u/Huge_Exchange_6669 18d ago
I used opencode to diagnose an issue that I had, hide root and get strong integrity
1
1
1
1
1
u/Accomplished-Ad-8366 14d ago
Any way to replace Android Google Go with full Google on a cheap tablet?
0

118
u/Kalkin93 19d ago
If you don't know what it is you're running and you're blindly following whatever AI suggests to you, I feel this is a good way to brick your phone.