Samsung Galaxy S4 Upgrade

OK, I won't moan about the NSA and GCHQ snooping overreach anymore - just secure everything you do to keep them and any other computer criminals out of your systems...

One way to improve security, is to install a proper GNU/Linux Android system on your stock smart phone.  To do that, you need to have super user (The Linux administrator account is known as the root user) access.  The process is generally described as rooting your phone.

By default, most phone manufacturers disable root access, since they do not want to be faced with a support nightmare due to millions of clueless users messing up their phones.

Once you have root access, you can install different software applications and delete the crud applications that the phone comes with.

There are various ways to get root access - you can do a minimal thing and only create a root account and install one or two basic utilities for root access, or you can completely replace the half baked Linux kernel that you get with your phone with a proper one that already has everything set up - this is much easier - but may not work in your region.

This guide is for the delightful little Samsung Galaxy S4 Mini GT-I9192. For other phones, you could use the links below to start the hunt for the correct versions of software.  Don't use the code linked below for a different phone model.

Get a Samsung Update

The first thing to do, is to get the latest Android build from Samsung, so that you can roll the phone back when you mess it up - not if, when...

Some friendly folks keep them here:
http://samsung-updates.com/device/?id=GT-I9192

For example KSA-I9192XXUAMH3-20131101105408.zip, which is the Saudi version sold in the middle east.

Some unfriendly folks keep trying to shut this archive down for no good reason, so you may have to root around on the net to find it again if it would disappear.

Make a Windows XP Virtual Machine

Get Oracle Virtualbox from https://www.virtualbox.org/wiki/Downloads and an old Windows XP install disk image.  I happen to own about a dozen copies of XP, so I have enough to last me till the next century.  Newer versions of Windows are ridiculously slow and XP works fine on a VM.

Once you installed it and also installed Guest Additions, make a tar backup of the whole thing so that you never have to install it again when it gets messed up with crudware - just untar a fresh VM from backup.

All of this works purrfectly fine on my Mac Pro.

Get the USB Driver

You also need the USB device drivers for the phone.  These are contained in a terrible buggy and unusable program by Samsung called Kies, which you can get here:
http://www.samsung.com/ae/support/usefulsoftware/KIES/JSP

The program looks nice, but it tends to crash as soon as you try to do anything serious with it, which of course can be a disaster if it would do so while downloading code to the phone.  I think it is written with Microsoft dotNet, which would explain it all.

You have to download and install the whole catastrophe just to get the USB driver.  This is one reason why I play on a Windows XP virtual machine on Oracle Virtualbox.  I don't want to mess up a perfectly good real machine with cruft.

Get the Odin Downloader

You can get the excellent Odin downloader from the friendly folks at XDA from here:
http://www.devfiles.co/download/HfyuZUjP/ODIN_v3.07.zip

Try to find the latest version though.

Get a Full Featured Amestris Linux Kernel

You can get a real, honest to goodness Linux kernel from the friendly folks at XDA here:
http://forum.xda-developers.com/attachment.php?attachmentid=2466812&d=1387635358

This kernel was prepared by MJ Nazari - Thank you MJ!

Unzip it with 7-Zip available from the good blokes here:
http://www.7-zip.org/download.html

Download Mode - the Three Button Salute

Getting the phone into download mode is a little tricky.  First, you got to convince the darn thing to turn off.  If you press the Home button and it turns on again, then it wasn't off...

• First turn the phone off
• Press Home, Volume, Power at the same time
• Then when the green screen comes up, let go and press volume up

How to get a Virtualbox Virtual Machine to see the USB connection

Virtualbox has a few funnies and if you just plug the phone in and try to connect to it, then you may get a message to the effect that the USB port is already used by someone else. To get around that, set up a USB connection Filter, so that it will connect the right way automatically.

• Power off the Windows VM
• Plug the phone USB cord in
• In the Virtualbox machine Settings, select port, USB
• Add a Filter for the Samsung phone
• Unplug the phone again
• Start the Windows VM
• Log in as Administrator
• Plug the phone in

Windows should now recognize it, but you may still not have the device driver.

Install the horrid Samsung Kies software to get the device driver.

Rooting Method 1

Install a root capable kernel

Now finally, you can run the virtual machine, log in as administrator, put the phone in Download Mode, plug the phone in, run Odin, wait for it to show a green [COM5], select the kernel in the PDA field and load the phone:

• Download the .tar file to your computer
• Power off your phone and hold the Volume down + Home + Power buttons simultaneously to boot into Download mode, then press Volume Up
• Start the Virtual Machine and log in as Administrator
• Connect the phone to your computer and wait a bit for the dust to settle in Windows
• Run Odin, select the tar file in the PDA or AP field
• Make sure F.Reset.Time option is unchecked
• Click on Start and wait a while for the kernel to download and save to flash memory
• When done, your phone will reboot by itself

Now you should be the proud owner of a Samsung phone with a proper Linux distribution on it that you can install secure software of your own choosing on and one of the new utilities on the phone should be SuperSU.

Rooting Method 2

Use Clockwork Mod (CWM)

If Method 1 above doesn't work for you, then try the CWM method described here:

http://forum.xda-developers.com/showthread.php?t=2494435

The instructions in that posting are pretty clear, except for navigating the Clockworkmod application, which took some fiddling around.

The advantage of this method, is that you will still run the stock Linux kernel and other software for your region, so everything on the phone should remain working.

Firstly, if something goes wrong and you cannot get into the Recovery Boot program, simply reset Odin, redo the Download Mode 3 finger salute and download the Recovery Clockwork tar file all over again.  I had to try multiple times before I got the hang of it.  You really have to hold the phone in your left hand when clicking the Start button, such that you can click Up Volume with your left thumb and press Home with your right hand (the 2 Button Salute) as soon as the phone vibrates.

Navigate the Clockwork menus using the volume button up/down and select an entry using the Home button - go back with the soft Back button to the right of the Home button.  

You may need to search around a bit to find the zip file on the SD card.  Once you get it, click Home.  When it is done, go back up in the menus till you get to the Reboot option.  Once rebooted, you should be able to find the SuperSU application on the phone.

This method finally worked for me, on my UAE (Saudi Arabian region) phone.

Problems

When the going gets tough, the tough gets going

Half the fun is dealing with all the problems - you certainly need to have a sense of Geek adventure for this process.

If the phone gets messed up, try again, or roll back to the Samsung stock regional version downloaded above.  Provided that you start off prepared and save a stock kernel for your regional carrier, you should not have to go and buy a new phone when things go south.  Well, let's hope so anyway.

On my first try, a few days ago with a completely different rooting method, the WiFi didn't work.  On my second try as above, the Cellphone network didn't work anymore, but WiFi worked fine - sigh.  However, after I reloaded the stock Saudi Arabian kernel yet again, the device worked again, so one can always roll back to the (unrooted) Samsung stock version.  The Clockwork Mod method finally worked and got my phone rooted successfully.

Once rooted one way or another, you can go and get Cyanogenmod (http://www.cyanogenmod.org/) or ParanoidAndroid (http://forum.xda-developers.com/paranoid-android) and change the whole look and feel of your new toy and install Orbot, Orweb, Chatsecure, SSH Autotunnel, SSH/SFTP Server, Terminal Emulator and other security applications to give the NSA/GCHQ/CSE the Salmon Arm Salute (http://toronto.ctvnews.ca/one-finger-salute-crude-to-ont-film-review-bd-1.368040).


La voila!

Herman

Écrasez l'infâme!

Now even the French is admitting to be going at it with no judicial oversight, just the same as the NSA and GCHQ and the Canadian CSE was found to misuse court orders granted for spying on citizens to allow other 5 eyes members to spy on Canadians on their behalf.

Voltaire

The mass snooping is not working, it is not catching any terrorists, it is a gigantic invasion of privacy and a colossal waste of money and resources that could be put to work more effectively. Furthermore, the whole thing is beginning to backfire.  Cisco is losing orders for switch gear, Boeing is losing plane orders to SAAB, while Blackberry was abandoned by everyone after they subverted their own security and RSA is losing disgruntled customers since they sold their soul for 10 million shekels of silver.

There is no war and no state of emergency, but the intelligence agencies are acting as if WW5 is under way.  This overreach has to stop.

What the Western Allies have now created, puts the old Catholic Church, its confessionals and inquisitions to shame.

As Voltaire so eloquently put it:  Écrasez l'infâme!

NSA Snoop and Error Proof Your Archives

An Englishman's Home is His Castle:

In 1760, William Pitt (the Elder) made a famous declaration of this right. "The poorest man may in his cottage bid defiance to all the force of the Crown.  It may be frail, its roof may shake, the wind may blow through it. The rain may enter. The storms may enter.  But the king of England may not enter.  All his forces dare not cross the threshold of the ruined tenement."

There is many a ruined castle in Europe.  You need to defend your castle if you want it to keep its value!

You should also consider the problem of data corruption, since any single bit error in an encrypted archive, will render the whole thing unreadable.

Also remember this: Always tar a directory, never tar a bunch of files. 

It is extremely annoying when you get an archive from someone, untar it and end up with a million files scattered throughout your home directory...

Encrypting an Archive with GPG

An easy way to secure your data against unwarranted NSA and GCHQ snoops is with gpg.  Always use gpg before uploading archives to a public file server such as DropBox, Copy or Evernote.

Using pipes, you can string the tape archiver tar, bzip2 and gpg together like this:

$ tar -cj test | gpg -c >test.tar.bz2.gpg

(or use gpg -er username for key based encryption)

and to reverse it:

$ gpg -d < test.tar.bz2.gpg | tar -xj

The key configuration of GPG is shown in another post. 

 

Forward Error Correction

A good way to protect your data against corruption is with a Reed Solomon forward error correcting code - it is used on CDROMs.  There is a little known utility available that does it, called rsbep by Guido Fiala and you can get the source using this link: http://www.filewatcher.com/_/?q=rsbep

Then build it the usual way with ./configure; make; sudo make install.  It is part of the BSD and Debian distributions.

Using pipes, you can string the tape archiver tar, bzip2, rsbep and gpg together like this:

$ tar -cj test | gpg -c | rsbep >test.tar.bz2.gpg.rs

(or use gpg -er username for key based encryption)

and to reverse it:

$ rsbep -d < test.tar.bz2.gpg.rs | gpg -d | tar -xj

The Reed Solomon code will protect your archive against error bursts and will help to ensure that you can read the data back from a failing archive system, many years later.

 

Parity Bits

There is also a utility called par2 (and the handy GUI PyPar2) which adds Reed Solomon parity bits in a series of separate files.  These are in the par2cmdline and pypar2 packages.  This can be used to protect any files, but when you copy things around, you got to remember to pass the parity data along too.

Preventive Measures Using Par2

In order to ensure that I get into and stay in the habit of using gpg, I created a couple of scripts, so I can simply do:

$ targpg directory
and
$ untargpg directory

and the scripts will handle the messy details.

I tested the error recovery by corrupting the archive with hexedit - it works like magic!

Make an archive script like this called /usr/local/bin/targpg:
#! /bin/bash
echo Make an encrypted archive of a directory
tar -cj "$1" | gpg -c >"$1.tar.bz2.gpg"
md5sum "$1.tar.bz2.gpg" > " $1.tar.bz2.gpg.md5"
parcreate -n1 "$1.tar.bz2.gpg"
ls -al "$1"*

as well as untargpg:
#! /bin/bash
echo Untar a GPG encrypted archive $1
RESULT=$(md5sum -c "$1.tar.bz2.gpg.md5")

if [ "$RESULT" != "$1.tar.bz2.gpg: OK" ]
then
  echo MD5 error - Attempt a repair
  par2repair $1.tar.bz2.gpg.par2
fi

# Try to decrypt and untar regardless   
# because the md5 and par2 files may be missing
gpg -d < "$1.tar.bz2.gpg" | tar -xj
ls -al "$1"*
 

and then one day when your disk goes south, par2repair may save the day.

La voila!