Rooting Samsung A51 for mobile pentesting
Samsung A51
Unlocking the bootloader.
- Just in case activate Google Account and Samsung Accounts in the phone in case unlocking failure
- In Settings -> Phone info -> Software information -> Build number: press 7 times the option to activate Developer mode
- In Settings -> Developer mode:enable OEM Unlock/Desbloqueo OEM and USB Debug/Depuracion USB
- Shutdown phone by pressing Power and volume Down, and after that select Power off option.
- Press simultaneously volume down and up and then plug usb cable.
- Release buttons when Samsung screen apears.
- Press short volume up to go into download mode.
- Reconfigure and enable again developer mode (1 and 2).
- Verify OEM Unlock OEM its grayed out.
Rooting
- Install Magisk Manager:
adb install MagiskManager-v8.0.2.apk
- Install Samloader
pip install git+https://github.com/nlscc/samloader.git
- Get samsung last update. At the time of this writing it works to me with this one. Unpack Firmware -> AP_* -> boot.img
samloader -m SM-A515F -r PSN checkupdate A515FXXU3BTI2/A515FOWB3BTH3/A515FXXU3BTH5/A515FXXU3BTI2 samloader -m SM-A515F -r PSN download -v A515FXXU3BTI2/A515FOWB3BTH3/A515FXXU3BTH5/A515FXXU3BTI2 -O . samloader -m SM-A515F -r PSN decrypt -v A515FXXU3BTI2/A515FOWB3BTH3/A515FXXU3BTH5/A515FXXU3BTI2 -i SM-A515F_1_20200910175004_86a4taxqdz_fac.zip.enc4 -o SM-A515F_1_20200910175004_86a4taxqdz_fac.zip unzip SM-A515F_1_20200910175004_86a4taxqdz_fac.zip -d SM-A515F_1_20200910175004_86a4taxqdz_fac cd SM-A515F_1_20200910175004_86a4taxqdz_fac mkdir -p AP_A515FXXU3BTI2_CL19494987_QB34065784_REV00_user_low_ship_meta_OS10 cd AP_A515FXXU3BTI2_CL19494987_QB34065784_REV00_user_low_ship_meta_OS10 tar -xf ../AP_A515FXXU3BTI2_CL19494987_QB34065784_REV00_user_low_ship_meta_OS10.tar.md5 unlz4 boot.img.lz4 cp boot.img boot-orig.img adb push boot.img /sdcard/Download
- From Magisk Manager, select Magisk -> Install -> “Select and Patch a File” and select the boot.img file and then tap on Start
- Copy patched file to PC
adb pull /sdcard/Download/magisk_patched.tar mv magisk_pathched.img boot.img tar -H ustar -c boot.img > boot.tar adb reboot bootloader
- Flash boot.tar with Odin in option AP. Auto Reboot must be off. I had some problems with Heimdal and my device.
- Enter recovery and Wipe Data (Factory Reset)
- Phone does one boot loop, and one slow boot
MITM Proxy certificate (Burp)
- Download last version of MagiskTrustUserCerts and copy to sdcard/Download (https://github.com/NVISO-BE/MagiskTrustUserCerts). At the tie of writing 0.4.1 is the last one.
wget https://github.com/NVISO-BE/MagiskTrustUserCerts/releases/download/v0.4.1/AlwaysTrustUserCerts.zip adb push AlwaysTrustUserCerts.zip /sdcard/Download/
- Enter Magisk Manager, on the module tap install AlwaysTrustUserCerts.zip and reboot
- Configure Burp to listen to your ip address with conectivity to wifi network. Ensure your firewall is enabled for incoming connectiosn in the port configured.
- Save cacert of Burp and copy to phone
adb push cacert.der /sdcard/Download/cacert.crt
- Open Download folder with My Files app or the file manager you are using and open certificate and install it as VPN/Applications certificate.
- Reboot phone to leave AlwaysTrustUserCerts copy the certificate to system store
- Configure Wifi using PC Host IP address/Port as proxy
Flashear TWRP (NOT WORKING YET, waiting new version of TWRP)
- Download TWRP not oficial https://droidfilehost.com/download/download-unofficial-twrp-recovery-3-4-0-for-galaxy-a51/
- Press simultaneously volume down and up and then plug usb cable.
- Use heimdall-frontend:
- Tab Utilities, Download archivo PIT
- Tab Flash, seleccionar archivo PIT.
- Add particion
- Select Recovery
- Choose recovery.img
- Click Start