Two bare Samsung Galaxy J7 Prime (SM-G610F / on7xelte) motherboards with no screens, batteries, or enclosures were recovered as headless aarch64 USB worker nodes powered directly from a regulated 4.2 V bench supply.
Because stock Samsung firmware boots with USB Debugging disabled (or requires an on-screen RSA prompt that cannot be tapped without a display), we used Samsung Factory Combination Firmware (FA60_G610FDDU1ARC1) flashed via Heimdall to bring up pre-authorized, passwordless ADB (uid=2000, SELinux Permissive) immediately on cold boot. We also conducted a forensic study across four privilege-escalation vectors while maintaining Knox warranty_bit = 0.
Hardware & Firmware Profile
| Field | Specification |
|---|---|
| Model | Samsung Galaxy J7 Prime (SM-G610F / on7xelte / on7xeltedd) |
| Nodes | 2× bare motherboards powered via 4.2 V bench supply on battery terminals |
| SoC | Samsung Exynos 7870 (universal7870, 8× ARM Cortex-A53 @ 1.6 GHz, 14 nm FinFET) |
| Architecture | aarch64 (64-bit kernel & userspace) |
| RAM / Storage | 3 GB LPDDR3 / 16 GB eMMC (11.2 GB free on /data) |
| Firmware | Samsung Factory Combination ROM FA60_G610FDDU1ARC1 (Android 6.0.1 Marshmallow, March 2018) |
| Kernel | Linux 3.18.14-10809540 (PREEMPT, SELinux Permissive) |
| Security State | Bootloader Locked (SECURE DOWNLOAD : ENABLE), Knox warranty_bit = 0, RP SWREV: B:1 K:0 S:0 |
Subsystem Status
| Subsystem | Mechanism | Status | Notes |
|---|---|---|---|
| Bench Power | 4.2 V regulated supply on VBAT+/GND | Working | Boots cleanly without battery thermistor fault on J7 Prime |
| Download Mode (Odin) | Volume Down + Home + Power / adb reboot download |
Working | Enumerates as 04e8:685d; flashes cleanly via heimdall |
| Screenless ADB | Combination ROM (persist.sys.usb.config=mtp,adb) |
Working | Pre-authorized adb shell (ro.adb.secure=0) out of the box |
| SELinux Mode | Engineering Boot Image | Working | Permissive (getenforce returns Permissive) |
| Compute Execution | /data/local/tmp (exec mounted) |
Working | Native static/PIE aarch64 binaries run at full 8-core speed |
Unprivileged Root (uid=0) |
Forensic evaluation (4 vectors tested) | Blocked by S-Boot / Kernel | Knox 0x0 preserved; see forensic summary below |
Screenless Recovery via Combination Firmware & Heimdall
Stock Android ROMs set ro.adb.secure=1 and default USB mode to MTP-only until a user unlocks the lockscreen and taps the RSA authorization dialog. On a bare motherboard without an LCD/OLED panel, that dialog is unreachable.
Samsung's internal factory test firmware (Combination ROM FA60_G610FDDU1ARC1) solves this cleanly:
- Ships with
ro.adb.secure=0,ro.debuggable=1, andpersist.sys.usb.config=mtp,adb. - Carries an official Samsung production cryptographic signature matching Revision 1 (
B:1), so a locked S-Boot bootloader accepts it without tripping Knox (warranty_bitstays0).
Critical Heimdall Flashing Discovery
While flashing the 24-partition G610FDDU1ARC1 archive on Linux using heimdall v1.4.2:
- Flashing only
BOOT,SYSTEM, andCACHEleft the device bootlooping when transitioning from Marshmallow (FA60) to Oreo (U1CRL3) bootloader state. - Multi-partition single-session rule: Samsung's Odin protocol on Exynos 7870 requires all partition arguments (
--CM,--BOOT,--RECOVERY,--SYSTEM,--MODEM,--CACHE,--HIDDEN) to be passed in a singleheimdall flashinvocation so the USB session commits and resets once at the end.
heimdall flash \
--CM cm.bin \
--BOOT boot.img \
--RECOVERY recovery.img \
--SYSTEM system.img \
--MODEM modem.bin \
--CACHE cache.img
Rooting & Bootloader Forensic Summary (Knox 0x0)
Because the Combination ROM runs a March 2018 build of Linux 3.18.14 with SELinux Permissive, we systematically tested four privilege escalation and boot-chain approaches—recording the exact kernel and S-Boot enforcement boundaries:
| Vector | Target Mechanism | Outcome | Technical Root Cause |
|---|---|---|---|
| 1. Tauchgang U-Boot | Chainloading mainline U-Boot encapsulated as an Android boot.img |
Blocked (SECURE CHECK FAIL) |
S-Boot verifies the Samsung RSA signature block at the tail of boot.img because OEM Unlock cannot be toggled in factory binary mode |
2. Dirty COW (CVE-2016-5195) |
madvise(MADV_DONTNEED) + /proc/self/mem race against run-as / play |
Blocked on ext4; Worked on tmpfs |
Kernel 3.18.14-10809540 (built March 2018) has Samsung's partial backport blocking dirty page writeback to read-only ext4 (/system/bin), while tmpfs pages carrying MS_NOSUID cannot grant setuid(0) |
| 3. CF-Auto-Root | Odin-flashable SuperSU recovery injection | Blocked (SECURE CHECK FAIL) |
Unsigned custom recovery.img rejected by locked S-Boot (SECURE DOWNLOAD : ENABLE) |
4. Byte-Padded In-Place boot.img Patch |
Changing ro.secure=1 → 0 inside gzipped ramdisk while preserving exact gzip size and trailing SEANDROIDENFORCE + RSA signature bytes |
Definitive Proof of Cryptographic Hash Check | S-Boot computes a SHA-256 digest over the kernel + ramdisk payload and compares it against the RSA-signed hash table—not merely checking the magic trailer |
Full forensic details and binary diff proofs are covered in the companion blog post: Screenless Samsung Bring-Up & Rooting Forensics on the Exynos 7870 (SM-G610F).
Device Tags: