downloads / artifacts
Everything we pulled from our own device, explained in plain words — organized so anyone can understand what each file is and why it matters. For the community to verify and build on.
how the phone starts — the boot chain, in order
Every phone boots through locked doors. These are the doors, pulled from our device.
The locked bootloader (scrambled)abl.elf.encrypted · 2.3 MBWhat the phone actually keeps on its storage — encrypted, unreadable until the boot chain unlocks it.The SAME bootloader (readable)abl.elf · 2.3 MBThe decrypted copy we pulled live from the phone’s memory. Same file, before and after the crypto — that pair is the proof.The security chip’s brainxbl_s.melf · 1.0 MBA separate RISC-V processor inside the phone that handles the anti-rollback fuses.The TrustZone OStz.mbn · 3.9 MBThe hidden secure operating system that runs alongside Android.The UEFI firmwareuefi.elf · 2.9 MBThe phone’s pre-Android software — the drivers we extracted came from here.
the key vault — keymaster + trusted apps
The secure-world apps that hold your keys and the lock state.
The keymaster app (the 24090 target)keymint.mbn · 0.4 MBThe app that answers the unlock-state questions — the one that said "Keymaster 5.3" to us.The VaultKeeper appvaultkeeper.mbn · 1.0 MBThe boot-lock state keeper — the app that tracks whether the phone’s been unlocked.The VaultKeeper manifestvaultkeeper.mdt · 0.0 MBThe header file that describes how the app loads.The S-KeyMaster manifestskeymast.mdt · 0.0 MBSamsung’s KeyMaster — the Android-facing key app.
the maps + the state — partitions and device info
The partition table (the map of the storage) and the state dumps.
The full partition tablegpt-primary.bin · 20.0 MBThe map of every partition on the phone’s storage — a byte-exact backup.The Verified Boot certificatevbmeta-backup.img · 0.1 MBThe signed metadata that proves Android hasn’t been tampered with.The keymaster partition dumpkeymaster.img · 1.0 MBThe raw contents of the key vault partition.The device state (the "SAMANDR-BOOT!" dump)devinfo.img · 0.0 MBThe partition that stores the unlock flags — the one we tested.
the doors we reverse-engineered — the libraries
The actual libraries that talk to the secure world, pulled from the phone and analysed.