ME7 BOOTLOADER UNLOCK ideas, dangerous unknown feasible - Verizon Samsung Galaxy S 4

I545 ME7 new version has a lock, do not accidentally brush or misuse upgrade, think about tossing a Brush Brush RECOVERY trouble. Is it possible to upgrade will not be downgraded? The answer is definitely no. Well, we want to downgrade, then understand its partition structure is a must. You know, in the end we have to upgrade to upgrade what was a result of being locked!
First, here is the I545 partition table structure:
Code:
lrwxrwxrwx root root 1970-01-01 16:14 aboot -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1970-01-01 16:14 apnhlos -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1970-01-01 16:14 backup -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1970-01-01 16:14 boot -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1970-01-01 16:14 cache -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1970-01-01 16:14 carrier -> /dev/block/mmcblk0p28
lrwxrwxrwx root root 1970-01-01 16:14 efs -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1970-01-01 16:14 fota -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1970-01-01 16:14 fsg -> /dev/block/mmcblk0p24
lrwxrwxrwx root root 1970-01-01 16:14 hidden -> /dev/block/mmcblk0p27
lrwxrwxrwx root root 1970-01-01 16:14 m9kefs1 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1970-01-01 16:14 m9kefs2 -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1970-01-01 16:14 m9kefs3 -> /dev/block/mmcblk0p15
lrwxrwxrwx root root 1970-01-01 16:14 mdm -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1970-01-01 16:14 modemst1 -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1970-01-01 16:14 modemst2 -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1970-01-01 16:14 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1970-01-01 16:14 param -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1970-01-01 16:14 persdata -> /dev/block/mmcblk0p26
lrwxrwxrwx root root 1970-01-01 16:14 persist -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1970-01-01 16:14 recovery -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1970-01-01 16:14 rpm -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1970-01-01 16:14 sbl1 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1970-01-01 16:14 sbl2 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1970-01-01 16:14 sbl3 -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1970-01-01 16:14 ssd -> /dev/block/mmcblk0p25
lrwxrwxrwx root root 1970-01-01 16:14 system -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1970-01-01 16:14 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1970-01-01 16:14 userdata -> /dev/block/mmcblk0p29
Know the partition table, then we have to look at the official ROM ME7 what is inside, at least to know what he upgraded partition was a result of being locked.
The following is the official package ME7 opened with RAR see:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You can see, there are 12 official package file , in fact, there should be 13 years , I feel like I had a SBL1.MBN delete the file, this is an important guiding document , a blank screen will be lost . Connection brush modes anyhow. So we know that under the first bar . BOOT.IMG is the core of the boot files will be lost card first screen . CACHE This is not , MODEM.BIN and NON-HLOS.BIN this is related to the baseband , I brush off alone , it will not be locked , and this has nothing to do , RECOVERY This is a card swipe mode , recovery mode , this is not , RPM is a power management scheme related , SBL2.MBN SBL3.MBN boot record which two are related , SYSTEM this is the system , nor is , TZ is that I do not understand what to do .
**Now the question comes, if not understand, a recovery in the past may have a try. Such high risk factor . Therefore, we even try , but also row a sequence . For example SBL1.MBN, this is the first boot , when this fails if the coverage directly on a black screen , and we try not to move it to this , at least we do not move it, cover the failure modes that can feed wire brush brush the official rescue package bricks ! Of course , this is not relevant to the lock BOOTLOADER .
***535 used all know , 535 is V version, it also has BOOTLOADER lock, then unlock 535 using what methods do, in fact, is replaced by the partition method, which is aboot.mbn replace this partition. In fact, it says so much just thinking, we can be like 535 as a direct replacement overwrite this partition. If not, then only SBL2 SBL3 SBL1 these three , this three risk factor is quite high, and our principle is can not move do not move these three !
Well, just say replace overridden methods !
First of all, we have to use ADB SHELL under the DD command. Then we will obtain ADB SHELL authority , which is first ROOT.
The ROOT method ME7 forum there, I will not say more . I direct that ADB SHELL command .
We go first to Taiwan MDK the machine, put a few partition backup, is SBL1.MBN SBL2.MBN SBL3.MBN and ABOOT.MBN If you are interested , you can put all of the above partition table partition backup under , be prepared to stay with maybe someday that can use ! ~ ~
Backup method is to obtain ROOT , enter ADB SHELL command:
Code:
adb shell
dd if=/dev/block/mmcblk0p3 of=/sdcard/sbl1.mbn bs=4096
dd if=/dev/block/mmcblk0p4 of=/sdcard/sbl2.mbn bs=4096
dd if=/dev/block/mmcblk0p5 of=/sdcard/sbl3.mbn bs=4096
dd if=/dev/block/mmcblk0p6 of=/sdcard/aboot.mbn bs=4096
To explain, dd command to copy the partition related commands, if the meaning can be understood as if it. If there IF = path behind the partition, partition backup to put this on the path of = this, SDCARD this is the path of built-in memory card, you can back up directly to an external memory card, you have to do to change the path down.
Next, we put the backup files are copied to the four external SD card, or copied to a computer backup.
Then again, we took our locked machine, and put the MDK overwrite these partitions ME7 partition. Cover only aboot.mbn oh.
We first connect the phone to the computer, the backup out who's copied to the phone's built-in memory card.
root, I do not say this directly into the adb shell input overrides command:
Code:
adb shell
dd if=/dev/block/mmcblk0p6 of=/sdcard/ME7_aboot.mbn bs=4096
dd if=/sdcard/aboot.mbn of=/dev/block/mmcblk0p6 bs=4096
Note that this command following the second IF = OF = position and the position in turn, because it is not backed up, it was restored. The first DD command can not operate, I was customary to put it back down. Be prepared!
Well, I write to you, these commands is very dangerous, and can not be successful looking at you peril Oh, I only provide ideas and does not promise any consequences. Understand their own caution to decide whether to try, do not understand it not tried!

---

New ideas are always appreciated. Thank you for your efforts!

---

There are two places to discuss this ...and remember, if you ever try any of this stuff, you do so at your own risk....
see http://forum.xda-developers.com/showthread.php?t=2500826
or
http://forum.xda-developers.com/showthread.php?t=2417713
or possibly here http://forum.xda-developers.com/showthread.php?t=2428226