Galaxy S10 bcm4375b1 patch update

[Yev-henii]

Do you have any plans to update the patch for the galaxy s10 on the bcm4375b1 chip? I tried to install nexmon on my device with android 12 on one UI 4.1 but nothing worked. After reading a little on the Internet, I found reviews from people who write that due to the driver update in the kernel from version bcmdhd_101_12 to bcmdhd_101_16 along with the kernel update, nexmon is no longer suitable for these devices and there is no way to roll back the version due to Samsung protection. Perhaps you can suggest some solution?

[Yev-henii]

bcmdhd_sta.bin_b1 Version=18_41_117

[Yev-henii]

bcmdhd_sta_bin_b1.zip

[Yev-henii]

This version is the latest update that arrived over the air for the s10, I think it would be useful for many people since it is difficult to specifically saw outdated versions

[savox-326]

i said that. Not sure about kernel driver version, when i last checked the new bcm binary worked fine with old kernel wifi driver, only thing which noticed was that wifi strength viewer wasn't work, shows always low signal. I guess this patch didn't work initially. I also applied nexmon's patches to new wifi binary, just viewing which on functions/block they did change. Also same behaviour - monitor mode wasn't work correctly. The problem is on patches, i think. Maybe need attach to other function or modify exist ones

[Yev-henii]

Could you please tell me if you are talking about the new firmware version 18_41_113_sta? It is in the firmwares folder along with the definitions.mk file, but there is no patch for it in the patches folder. I want to patch it with the patch from 18_41_8_9_sta by finding and modifying functions in the local_wrapper.c file. I have found almost all the new function names using bindiff in Ida Pro, but now I am facing the issue of not being able to find this function in the 18_41_8_9 firmware to match them:

AT(CHIP_VER_BCM4375b1, FW_VER_18_41_8_9_sta, 0x1FD9BC) int called_by_wlc_ioctl(struct wlc_info *wlc, int cmd, char *arg, int len) RETURN_DUMMY

Have you tried doing this?

Also, I want to eventually try to patch my firmware version 117, but I don’t yet know how to change the values in definitions.mk for it.

I would appreciate any help because I am absolutely far from programming.

[0xIO32]

@jlinktu you did commit the firmware for bcm4375b1 version 18.41.113.
I am assuming you have the needed knowledge to help us do the same for the 18.41.117 version?

[davidrozen76]

On Samsung Galaxy S10 SM-G973F, you should be using bcm4735b1 driver version 18.38.18 in order for the nexmon patches to work.

[Yev-henii]

Patch 18.38.18 works only on the initial firmware versions. The latest firmware versions for the S10 that I downloaded and unpacked have driver versions 18.41.117 or 18.41.113. Version 18.38.18 does NOT work on the latest firmware, even if you rebuild the kernel with the old driver version bcmdhd_100_10. Rolling back to a very old firmware is not possible due to Samsung's policy, so the new firmware file needs to be patched. Its functions differ significantly from version 18.38.18 and are more similar to the firmware of the S20 than the S10, but it still doesn't work.

[davidrozen76]

Patch 18.38.18 works only on the initial firmware versions. The latest firmware versions for the S10 that I downloaded and unpacked have driver versions 18.41.117 or 18.41.113. Version 18.38.18 does NOT work on the latest firmware, even if you rebuild the kernel with the old driver version bcmdhd_100_10. Rolling back to a very old firmware is not possible due to Samsung's policy, so the new firmware file needs to be patched. Its functions differ significantly from version 18.38.18 and are more similar to the firmware of the S20 than the S10, but it still doesn't work.

I can confirm that compiling the kernel with driver version 18.38.18 works.

EDIT: (On Android 10). It might also work on Android versions higher than 10 given you successfully compile the kernel with the 18.38.18 driver.

[Yev-henii]

Version 18.38.18 does not refer to the kernel driver but rather to the firmware file bcmdhd_sta.bin_b1, which you can replace by simply copying it to the vendor/firmware path in the device's memory. The chip driver, on the other hand, is located in the kernel source at drivers/net/wireless/broadcom and has version names like bcmdhd_100_10, bcmdhd_100_15, and bcmdhd_100_16.

I compiled the kernel with the bcmdhd_100_10 driver version instead of bcmdhd_100_16 and also patched the bcmdhd_sta.bin_b1 firmware file (version 18.38.18) using the Nexmon patch. I can assure you that this does not work on the latest firmware with Android 12. You can verify this by downloading the kernel built with the older driver from this link:

https://github.com/Yev-henii/android_kernel_beyond1_lpos/releases/download/Bcmdhd_100_10/LPoS-S10-Bcmdhd_100_10-twrp-permissive.zip

and replacing the bcmdhd_sta.bin_b1 v.18.38.18
file patched with Nexmon, which I have attached to this message:

bcmdhd_sta.zip

[davidrozen76]

Have you tried this on Android 10?

[Yev-henii]

No, I haven't tried Android 10, and I'm not sure if such a rollback is possible, as Samsung doesn't always allow downgrading the One UI version due to bootloader updates. In any case, I would prefer to stay on Android 12. I will try to do what you wrote later.

[Yev-henii]

So, I tried your command:

nexutil -k1
nexutil -g0x613 -i -v2

and it partially worked. Now, when I run the command:

sudo LD_PRELOAD=./libfakeioctl.so airodump-ng wlan0

instead of a blank screen, I can see the surrounding Wi-Fi networks, and it looks like monitor mode. However, this only works in mode nexutil -m0 and not m2.

I didn’t even have to flash the kernel with an older driver version since it worked on the latest version, although I’m not yet fully sure if it functions as intended. Still, there’s at least some progress.

Could you explain what happens when using the command nexutil -g0x613 -i -v2?

[Yev-henii]

By the way, using your method, everything worked perfectly even on firmware 18.41.113

[Yev-henii]

Now I have an issue with setting the channel. When I select any channel, for example, nexutils -k1, the channel doesn't lock; instead, it constantly cycles through all channels, searching for all networks on other channels.