[FEATURE] Bypass camera limitation with unlocked bootloader

[309040521]

Can you please add support for the Samsung device's active cameras functionality after BootLoader?
I greatly appreciate it. I can assist with testing and provide logs.

My device model: Samsung Z Fold3 5G
ROM:
AP_F9260ZCU4GWH5_F9260ZCU4GWH5_MQB69290723_REV00_user_low_ship_MULTI_CERT_meta_OS13.tar
CSC_CHC_F9260CHC4GWH5_MQB69290723_REV00_user_low_ship_MULTI_CERT.tar

可否增加支持Zfold设备BootLoader之后可正常打开摄像头的功能,非常感谢,我可以协助测试及日志提供.

[salvogiangri]

Please send your /vendor/lib64/hw/camera.qcom.so lib so I can check it out.

[309040521]

Thank you very much for your response. Please use the following link to download this file. Thanks again!
https://www.mediafire.com/file/jibpjjwbfpsuyej/camera.qcom.so/file

[309040521]

I can provide remote access for you to investigate.if you don't mind

[309040521]

If there's anything else you need to know, please let me know. I'm more than willing to provide assistance.

Here are the steps:
1.Unlock the bootloader.
2.Flash the ROM and Magisk.v26.3.apk
3.Install:
Patch-Enhancer-v0.4.zip
LSPosed-v1.9.1-6990-zygisk-release.zip
KnoxPatch-v0.6.1.apk
4.After restarting the phone and opening the camera, the buttons within the app work as expected, but the camera screen remains black. The issue persists whether switching between the front and rear cameras. Approximately 30 seconds after the app is opened, an error occurs, and the error message states: 'An error has occurred.

[salvogiangri]

I've already dealt with such an issue in my Galaxy A52s 5G as it has a check in the camera HAL that prevents it to work when the bootloader is unlocked (tho this is limited to devices with a rear SLSI camera sensor). Looks like it is the same in your device:

Give a try to some Magisk/KSU modules that spoof the bootloader unlock prop(s): USNF, MagiskHide Props Config

[309040521]

I have already changed 'ro.boot.verifiedbootstat' to GREEN, but the camera screen remains black.
The modification steps were as follows:
1.Installed and activated 'safetynet-fix-v2.4.0-MOD_2.0.zip' and 'MagiskHidePropsConf-v6.1.2.zip' in Magisk.
2.Installed Termux and rebooted the phone.
3.Opened Termux and used 'su' permissions to execute 'props.'
4.Checked that 'ro.boot.verifiedbootstat' is green.
5.The camera screen is still black.

[salvogiangri]

I have already changed 'ro.boot.verifiedbootstat' to GREEN, but the camera screen remains black. The modification steps were as follows: 1.Installed and activated 'safetynet-fix-v2.4.0-MOD_2.0.zip' and 'MagiskHidePropsConf-v6.1.2.zip' in Magisk. 2.Installed Termux and rebooted the phone. 3.Opened Termux and used 'su' permissions to execute 'props.' 4.Checked that 'ro.boot.verifiedbootstat' is green. 5.The camera screen is still black.

Could be the same as here where safetynet-fix spoofs the bootloader props too late at boot and won't apply to the camera HAL: https://github.com/Displax/safetynet-fix/blob/67d1d1b86e145a8ddcd2f023ac878dc6d23ee3db/magisk/service.sh#L27-L46
Try spoofing your device props with MagiskHide Props Config and see if the issue persists.

[309040521]

I've tried, but it's still not working. Could you please help me check if I made a mistake in any of these steps? Thank you!

1.Open Termux and execute 'su' for permissions.
2.Type '4' for 'edit MagiskHide props.'
3.Type '1' for 'ro.boot.verifiedbootstate.'
4.It shows 'currently set to green by this module.

[309040521]

I've come across a strange situation; when I check the system, 'ro.boot.verifiedbootstat' actually indicates 'green'

[309040521]

[salvogiangri]

I've come across a strange situation; when I check the system, 'ro.boot.verifiedbootstat' actually indicates 'green'

As I said in #53 (comment) the issue is due to the prop being spoofed too late at boot by the USNF module. We can try hex patching the lib and eventually integrate the fix in the Enhancer module.

[309040521]

We don't have any experience in this area(try hex patching the lib). Could you please guide us on how to get started?
Thank you very much!

[salvogiangri]

We don't have any experience in this area(try hex patching the lib). Could you please guide us on how to get started?

Thank you very much!

On A52s case we replace the bootloader prop in the lib with another one so that the camera lib reads that instead (or SELinux blocks it so it fallsback to the default value). https://github.com/LineageOS/android_device_samsung_a52sxq/blob/999b94dc151b00467c4c287e2b42828200b6e0e2/extract-files.sh#L12
The same can be tested in your device, I'm not at home right now so I can't send you the patched libs to be tested.