Samsung Galaxy S5
Installing CyanogenMod-12

See also: Upgrade to CyanogenMod-13.

Link to the CyanogenMod installation page for klte. Here I'm documenting what I actually did; the reader should take the CyanogenMod page as authoritative and not blindly follow my mistakes.

• To obtain the CyanogenMod package for the device, go to CyanogenMod download page for Samsung Galaxy S5 klte. You need an exact match to your chassis. In particular, this image is unlikely to do well on the SM-G900H which has the Samsung Exynos octa-core chipset. Since these are nightly builds, I'm going to go through the most recent instances and do a Google search to try to identify bad builds. Using keyword cm-12-20150425-NIGHTLY (with various dates).

  There are few comments indexed on Google. Here is what I found:

  • kido0707 (2015-04-26) on klte found his calendar wasn't syncing to Google. No responses. For 20150422-NIGHTLY. (Jimc says: maybe this image should be avoided. Or maybe he didn't clear cache, see the last item.)
  • newton0211 (2015-04-23) on OPPO. He put on the wrong version of gapps, causing a bootloop. After reflashing, "com.google.process.gapps has stopped" once a second. People recommend to clear cache and clear Dalvik cache. (Jimc should not reject this image.)
  • famu97 (2015-04-22) on LG G2 (D800) says: cell connection drops out and rescans every few seconds. (No replies.) (Jimc says: see the previous and next comments. Jimc should not reject this image.)
  • Neroxx (2015-04-24) on OnePlus One: 20150417 nightly was OK, 20150422 nightly made it bootloop; needed to factory reset to get it to boot. 20150423 installed smoothly. His speculation: in the jump from Android 5.1.0 to 5.1.1 you need to factory reset.
  • Jimc's conclusion: I should probably use 20150423 and should stop here in scanning older versions for problems.

  I downloaded cm-12-20150423-NIGHTLY-klte.zip from the CM download page. 270Mb download. Saved as /home/jimc/upgrade/orion/files/cm-12-20150423-NIGHTLY-klte.zip

• Also needed is the Google Apps package (link to CyanogenMod wiki page). You need the correct one, which appears to be the 20150420 package for CM-12.1, the series based on Android-5.1.0 or 5.1.1. 72Mb download. File saved as /home/jimc/upgrade/orion/files/gapps-5.1-2015-04-20-15-56-24.zip

• Obtain an unlocked recovery image. Images are specific per model (CyanogenMod chassis name) and you need an exact match to your device. For example, on klte (Galaxy S5 with the Qualcomm Snapdragon 801 chipset), do not try to run the variant for the Samsung Exynos chipset, nor the Galaxy S4 variants. I'm using the popular and excellent ClockworkMod Recovery. Look in Koush's download page for ROM Manager. Find the device… Here's an embarrassment: there isn't an official ClockworkMod Recovery for Galaxy S5 klte.

  I'm not quite sure what I'm seeing in Google searches, but here's how I read it:

  • One of several download pages for Philz_touch Recovery based on ClockworkMod Recovery. This link points to the version for Galaxy S5 (klte).

  • Phil3759 announced CWM 6.0.5.1 - PhilZ Touch 6.59.0 including support for the Galaxy S5. However, in the same thread dated 2013-03-22 he reports that ClockworkMod Recovery (by Koush) is no longer being worked on, and he also will stop working on Philz_Touch.

  • An alternative to CWM is TWRP, which gets active development; last release was 2.8.6.0 dated 2015-03-26. They do have Recovery for the Galaxy S5. Forum moderators say that TWRP is equally as good as CWM and the feature set is very similar. This is what I will use.

• To obtain TWRP-2.8.6.0, visit Team Win's website. Follow the Devices tab. Find your device: Samsung Galaxy S5 Qualcomm (klte) -- It's there. Click on the line item link, download from the recommended primary source, and follow through their download links (avoiding to download toolbars and similar software from which they get a fee). 13.6Mb to download. Unfortunately they don't believe in MD5 sums, nor in gzip compression; however, the payload compresses only about 15% so it must already be compressed. Extract the payload (called recovery.img) before running Heimdall. File saved in /home/jimc/upgrade/orion/files/recovery-twrp-2.8.6.0-klte.img .

  This image is not signed by Samsung; do not install this image if the booter requires signed images, e.g. on Verizon or AT&T carrier subsidized phones.

  Assuming your booter is unlocked, the TWRP download page gives 3 installation methods: If a recent TWRP is already installed, you can use it to upgrade TWRP. If your phone is already rooted you can use dd to copy the image directly into the recovery partition. (Scary.) You can put the phone in download mode and use Odin (for Windows) or Heimdall (for Linux) to send over the image. (Root not required.) I'm going to use Heimdall.

• Install Heimdall on the desktop machine (Jacinth). For OpenSuSE Linux, go to the SuSE Build Service search page and search for heimdall. Heimdall-frontend is in the sub-packages list, and I'm installing it too, though the CyanogenMod page assumes using heimdall through the command line. They are in the hardware unstable sub-repo and I got version 1.4.1 of both. 137kB (compressed) to download, 395kB installed.

• You also need the ADB (Android Debug Bridge) program. It is part of the Android Software Development Kit. A seriously back-version ADB, e.g. the one for Android-1.5 Cupcake, will not talk to a modern bridge agent, and you will need to upgrade. It also will not have the latest features such as builtin backups. See this Cyanogenmod wiki page for the Android SDK, which has a link to the official Android site from which you can download it.

• It would be prudent to have a stock image to load in case things go seriously wrong. See this HOWTO on W0lfDroid by MrW0lf (relative dates only, possibly around 2015-02-xx). You know the recipe for Beggar's Chicken? It begins, First steal a chicken. Can the chicken be found at the real Samsung download and customer support site? Evidently they don't use SM-G900M as the model number; they want to see something akin to SM-G900RZKAACG. I guess I'll have to get physical possession of the phone before I know the Samsung model number. Also it looks like this page has accessories, and Windows drivers for the Android USB link (used by Odin), not the actual firmware. Maybe it's on Samsung Brasil. Image version: G900MUBU1BOC4 , model that I'm trying: SM-G900MZBAZTO . No, can't find this image. Maybe because it's carrier specific.

  Stock images are available from samsung-updates.com (not affiliated with Samsung). To use their site, go through the long dropdown list under Select Device and pick SM-G900M. In the list of images look for the one for your region: all South American. I'm snarfing the one for Android 5.0 in Brazil (ZTO) dated 2015-03-04. They have their annoying ways to motivate you to pay for their site. I never did get a stock image from any of these sources.

• However, the stock image on the phone (KitKat) downloaded a Lollipop image by itself. It's somewhere on the phone and the updater app bugs you frequently to install it, but without rooting the phone I can't find it. Update: it's in /data/fota which you can only get to if rooted.

• My plan at this point is to install TWRP Recovery and use ADB to dig around and retrieve these items:

  • Stock image for Android-5.0 Lollipop.
  • Fingerprint reader software including the background service if any.
  • NFC payment support with Host Card Emulation.

  The retrieved apps would be for KitKat. The ideal would be if I could disassemble the stock image and retrieve the non-CM apps (for Lollipop) at my leisure. Update: Something, most likely Google Wallet itself, has the infrastructure for one successful Google Wallet transaction over NFC. Details of debacle here.

• On a forum someone asked how do you guys brick your phones? One person said that while he was flashing a new image his cat knocked the phone off the table, disconnecting the USB cable. Remove cats and similar chaos generators from the room.

• To get the S5 into download mode (Samsung's version of Fastboot): Disconnect the USB cable. Turn off power. Hold down (all at the same time) Home, Volume Down, and finally Power, until it vibrates and shows the alternate boot screen. (Volume Down is the south end of the volume rocker, away from the logo Samsung. Volume Up is the north end.) Promptly hit Volume Up to select download mode (versus booting the main OS). Blow off the lurid warning about installing unapproved software. It will say it is in Odin Mode (in red) and will show an android titled Downloading. Once it is in download mode, reconnect the USB cable.

• Follow the instructions on the CyanogenMod installation page for klte. Change directory to where your recovery.img file is located. (You should have extracted this from the recovery.tar file already, and you may have renamed it to include the source and version in the filename.) You don't need to be root on the desktop machine. The recommended command line is: (substitute the actual filename if you renamed recovery.img)

  heimdall detect --verbose --stdout-errors #Prints Device detected
  heimdall print-pit --verbose --no-reboot --stdout-errors --resume
  heimdall flash --RECOVERY recovery.img --no-reboot --resume

  A blue dot appears, but it failed to download the PIT file (like a partition table on Intel machines). The key error message was ERROR: libusb error -7 whilst sending bulk transfer. Retrying… See this bug report on the author's (Benjamin Dobell) Github area. The OP was utkanos (2014-06-10), and he had this same experience. In this report quite a number of people had various related but not always identical problems, and there are other bug reports about this and related issues. It's being worked on (last post on this report is 2015-02-19) but is not definitively fixed.

  Alternative instances of heimdall-1.4.1 on SuSE Build Service are not promising. The most recent, from Stefan Bruens (about 2015-04-05), had the same error. Compiling from source: I'm reluctant because several uncommitted patches are needed and they don't seem to help very many people.

  lsusb reports: ID 04e8:685d Samsung Electronics Co., Ltd GT-I9100 Phone [Galaxy S II] (Download mode). This is what the stock booter says; it obviously has not been updated for later models. Also when you run heimdall detect, it reports Product: MSM8960; a forum poster says his SGS 5 (international) is really product MSM8974AC.

• Can I use Odin? Do I have a machine I can install Windows on? 162 updates later…

  Link to Odin-3.07 for Windows on samsung-updates.com.

  Howto on XDA-Developers.com about Odin by malybru (2014-01-28) with download links. You need to get a version of Odin that recognizes your phone and its protocol quirks. You also need Windows USB drivers. The compatibility table predates Galaxy S5, but Odin-3.07 is almost certainly too old. I'm going to assume that Odin-3.10.x is OK.

  Article on AndroidCentral.com with Odin download links by Tausaf Akram (no date but comments start about 2014-01-xx). This one for Odin-v3-09.zip (0.95Mb). I used this one to flash TWRP Recovery successfully.

  You will also need the USB driver. Samsung Android USB Driver for Windows (2015-02-10, from an official Samsung site for once!) On this page is a link to a zip file containng the actual driver. (The driver from 3 years ago for the Galaxy S3 worked OK.)

  Steps:

  • Unzip your Odin zip file. Right click on the filename and the context message will include Extract All. The content will be extracted into a directory and the exe file will be inside.
  • If you don't have the USB driver, double click on its zip file.
  • Copy or download the TWRP recovery tar file (not img file) to the Windows machine.
  • Boot the phone into Download Mode.
  • Connect the USB cable between the phone and the Windows machine.
  • If you haven't done this before, Windows will try to install the USB driver. Uncheck Search Windows Update because the driver is not there. Wait for it to find the driver. You should see that the Android Composite Device and the Android USB Modem are ready for use.
  • Start (double click on) odin.exe. This description is for odin-3.09 and other versions' UI seems to be slightly different.
  • Under ID:COM it should show some cryptic numbers with a cyan background: in my case, <ID:0/005>. If not, make sure the USB cable is connected and the drivers are found.
  • Uncheck the auto-reboot option (unless you want to boot directly into the OS, which you don't).
  • In the middle column under Files, click on the AP button (PDA button on Odin-3.07). Browse for your TWRP tar file. Leave all the other filenames blank unless you know more than I do about Odin.
  • You're ready to go. Click Start.
  • In the top row it says it's flashing RECOVERY (good). A progress bar appears on both Odin and on the phone. The process takes only 5 to 10 seconds. When finished it should show RESET in red, in the top row.
  • Now it sits there doing nothing obvious for at least 2 minutes. Eventually it should announce PASS! in green on the top row.
  • Unplug the USB cable. You can exit from Odin.
  • The phone isn't supposed to have rebooted yet. Hold down power for 10 to 15 secs; the screen will go black; wait another 5 secs; the phone will vibrate briefly and then will really be powered off.
  • Boot directly into Recovery. Hold down Home, Volume Up, and finally Power, until it vibrates.
  • I didn't do anything, just verified that it was TWRP Recovery. Hit Reboot. In the reboot menu choose System.
  • There was no warning that the main OS might overwrite the custom Recovery. Other images (e.g. Verizon) do this.
  • Nice program: it announces that the phone is not rooted and offers to install Chainfire's SuperSU. I accepted its offer.
  • The program was installed and it booted the standard OS. It announced that Android is Updating, meaning compiling the bytecode for apps installed behind its back.
  • It has rooted the phone, but doesn't yet have the GUI, but it installed an installer for the SuperSU GUI. Once the phone boots, there's a notification for it. Click. Follow the instructions (I downloaded successfully from Google Play). Once on the Google Play page, hit Update, and accept the intents.
  • It wants to update the SU binary. I used the normal installation method.
  • It detected Knox. I chose OK. It succeeded in turning off Knox.
  • It wants to reboot the phone. OK, did it.
  • I ran the GUI and checked the settings. The only thing I changed was the date format in the logs.

• Now that I'm rooted, I'm looking for the update file again. Empty means that ES File Explorer reports that the directory is empty. In some (all?) cases that is a lie.

  • Nowhere on the internal SD card.
  • Nowhere on the external SD card.
  • /system
  • /data (empty) (not really)
  • /cache
  • /persist (empty)
  • /efs (empty)
  • /persdata/absolute (empty)
  • /firmware (empty)
  • /firmware-modem (empty)
  • /mnt/shell/privatemode (/mnt/shell is allegedly empty)
  • /mnt/shell/knox-emulated
  • /mnt/shell/emulated
  • /mnt/media_rw/extSdCard and /storage/extSdCard

  Now that I have SuperSU, I can do: adb shell ; su. I should be immune from whatever tampering afflicts the apps and the non-root shell.

  Bingo! /data/fota/update.zip (933Mb compressed) looks promising. Mode is 600 system:system, and adb pull lacks permission to read it. I needed to do "chmod 644 /data/fota/update.zip" in a SU shell, then it worked. (And then I put the mode back to 600.) It took 230 secs to download, 4Mb/sec.

  Unfortunately unzip chokes on the index of this file, using about 1024 bytes of binary crap as the second filename, which should be META-INF/com/google/android/update-binary (according to strings). I suspect it's a security by obscurity scheme to keep people from stealing the content of the file like I planned to do. Instead of reverse engineering the file format, I'm just going to apply the update, then (I hope) steal the apps off the phone itself.

• Next job is to identify the print reader and the payment app. These from /system/app look interesting: Well, none of them. I'm going to download /system/app and /data/app and save them.

  A prerequisite is Busybox, for the tar command. This command line works: adb shell su -c tar -c -C /data/app -f - . > ! ./data-app-kk.tar Works is a relative term. The resulting tar file had mcRegistry followed by ./com.android.vending-1.apk, then tar: A lone zero block at 53858.

  This forum post on askubuntu.com by OP wael (2012-07-28), answer by ce4: adb combines stdout and stderr. You need to make stderr disappear. I was not able to get a command line to do that because of issues with quoting and shell-active characters -- the redirection occurs on the host, or the whole command line is interpreted as a command name. So I wrote the tarfiles onto my SD card (470Mb and 617Mb) and retrieved them with adb pull. Now they are readable.

• The next step will be to apply the update, and to do the whole procedure from the beginning. Hope it doesn't choke on TWRP Recovery. Yes it does. The operating system on your device has been modified in an unauthorized way…

• Too much risk that I'm unable to come up with the required files, specifically unzipping the archive. I'm going to move forward and install CyanogenMod.

• Rejoining the CyanogenMod wiki installation page for klte: Copy the CM and Google Apps zip files (previously downloaded) to your internal SD card (they say in the root, but any directory probably will do). Any functioning method is OK, but adb push is what I will use. Destination is /sdcard/. CM image is 270Mb (74 secs), Google Apps is 75Mb (21 secs).

• Boot into Recovery: Disconnect USB. Power off. Hold Home, Volume Up, finally Power, until it vibrates (release Power). Release the others when the blue text appears saying Recovery Running. Quickly it will show the TWRP main menu.

• Steps:

  • Wipe button. Confirm by swiping the slider. Does it, takes 60-90 secs. Hit Back, then the phone's Back button (arrow) to return to the main menu.
  • Hit Install. You get a file browser. It starts out in /sdcard. If your zip files are elsewhere, find them, but mine are at the end of this dir listing. Click on it. Swipe the slider to confirm flashing. Does it, takes 35 secs, message says Successful.
  • Hit the Home button.
  • Similar procedure to install Google Apps. Takes 20 secs.
  • Hit the Reboot button. (Or return Home, do other things, then reboot.)
  • It boots (with warning in red, Kernel is not SEANDROID Enforcing).
  • The initial boot takes extra time, including an Android is Upgrading sequence for 88 apps. Takes about 4 minutes total.
  • It dumps you in the Welcome screen.
  • Unfortunately, Google Play Services has stopped. Forum posters suggest this is a permission problem.
  • Isn't that nice? After about 10 mins of continuous stops which I ignored, it shut up, or at least became a lot less frequent. Continuing with the welcome app.
    • Wi-fi setup.
    • Do you want to leave mobile data turned on? (yes)
    • CyanogenMod account (existing).
    • Report usage statistics. Decline secure SMS.
    • Refuse location information.
  • That did not solve the problem with Unfortunately, Google Play Services has stopped. My first try will be to reinstall CM and Google Apps again over themselves. Did not help.
  • Could I have the wrong Google Apps? The package I'm installing is no longer on the CM wiki page for Google Apps. It does have a package dated 2015-05-03 for CM-12.1. Let's re-do the scan for bad nightly builds and pick one dated after 05-03. Searching for cm-12-$DATE omitting NIGHTLY-klte.zip.
    • cm-12-20150510: One person complains of a wakelock in Dream Manager Service, and it eats battery. Reply, Privacy guard is your friend… disallow wakelock.
    • cm-12-20150509: Changelog for 05-10 says 05-09 didn't show the version correctly. Someone anonymous on a d802 finds when he turns on Bluetooth (LE), Wi-fi shuts off.
    • cm-12-20150508: No complaints seen.
    • cm-12-20150507: Users on oneplus-one, Note 4, Nexus 7 find that voice search records the phrase but doesn't do the search. Voice trainer can't use (open?) the microphone.
    • cm-12-20150506: No complaints seen.
    • cm-12-20150505: On Oneplus-One, Rowinggeorge upgraded from 20150429 to 20150502 and got into the google play crash syndrome. Recommedation is to use the latest CM12 and Google Apps and wipe the device first. No news whether it finally worked.
    • cm-12-20150504: A newbie keeps losing Wi-fi. No replies. Someone on jfltexx (Galaxy S4) has a boot problem, doesn't start CM boot (on any version). He solved it by formatting /system before installing.
    • Conclusion: use cm-12-20150506.
  • There are gapps variants for arm and for arm64. Which should I get? On the XDA-Developers.com development thread for klte, alteam (2015-04-05) asks the same question and Regi24 responds, Galaxy S5 (Snapdragon 801) is a 32bit processor. maikinho10 says similarly, and mentions that the Nexus 9 has a 64bit processor.
  • OK, Google Play Service has not crashed for 15 secs, maybe the problem is solved. Going through the welcome app again.
  • Tap and Go: use NFC to transfer account data from another Android device. I'm going to try it. Start the other device, turn on its NFC, place back to back until they beep, then you're done (?). It just did my Google account, not OwnCloud, Firefox, etc.
  • And yes, I can use the Play Store!
  • Developer options -- in About Phone, hit the build number 7 times and it will be turned on. Options: Advanced Reboot, Stay Awake (don't sleep while charging, for the Night Clock app), Root Access = ADB and Apps, Android Debugging, Hostname = Orion.

We are now operational on CyanogenMod. The next steps would be to to check out features in CyanogenMod, to re-configure my preferred settings, and to restore all the apps.