Samsung Galaxy S20's version 18.41.113 seems partially completed in the repository? Is that reasonable to get working?

[falconscript]

Configuration:
Samsung Galaxy S20+
e OS (SELinux permissive)
Rooted with Magisk, flashed apk in recovery
Patched BCM nexmon bcm4375b1/18.41.8.9 (Native unpatched from system is 18.41.117)

The long and short of it:
18.41.8.9 seems impossible for the S20, but version 18.41.113 seems partially completed in the repository? Is it reasonable to get it working?

So 18.41.8.9 won't work on the latest OneUI, and reverting the S20 to an earlier OneUI version seems impossible due to the Samsung bootloader restricting downgrades. So for the S20/S21 models, nexmon isn't possible anymore.

Patched BCM 18.41.8.9 almost works, I'm able to run tools like tcpdump/airodump-ng, however they receive no output or packets on screen. nexutil -m reports an error code, and I often get -22 error code with other operations. I compiled nexmon/the patches/utilities, including modifying the Makefiles to support arm64-v8a (64-bit), and made scripts to collect and install all 64-bit/32-bit binaries/libraries, which I could share here.

I notice there is another folder for a modern bcm firmware for this chip, and it's in nexmon/firmwares/18.41.113, but there is not a corresponding folder in nexmon/patches for 18.41.113. Does this mean it was never completed? Would that be something reasonable to do?

So my question is, what would the options be to get the firmware working on the S20?

• Compile an up-to-date kernel of "e OS" or something similar, but use the brcmfmac driver from nexmon/patches/driver folder? Which version would I use?
• Find the addresses somehow for the new firmware version? Are the addresses, or clues to them, within the firmwares/18_41_113_sta folder?
• Is it easy to create a patch from an existing version? I tried taking nexmon/patches/18_41_8_9_sta and copying it to use as a template to build with 18.41.113's firmware, but it throws some errors even after changing the versions in some of the files.

[jlinktu]

18.41.8.9 seems impossible for the S20, but version 18.41.113 seems partially completed in the repository? Is it reasonable to get it working?
I notice there is another folder for a modern bcm firmware for this chip, and it's in nexmon/firmwares/18.41.113, but there is not a corresponding folder in nexmon/patches for 18.41.113. Does this mean it was never completed? Would that be something reasonable to do?

All you have to do is take the nexmon patch of version 18.41.8.9 and adapt all patch and wrapper function addresses to match version 18.14.113.

Compile an up-to-date kernel of "e OS" or something similar, but use the brcmfmac driver from nexmon/patches/driver folder? Which version would I use?

Why would you want to do that? I recommend you to stick with the bcmdhd driver from Google's Android sources. If you insist on using brcmfmac, you would, if available, take it from the upstream kernel sources for your OS, or alternatively directly from the upstream linux kernel sources, and implement modifications as required before compiling.

Find the addresses somehow for the new firmware version? Are the addresses, or clues to them, within the firmwares/18_41_113_sta folder?

Everything you need to make use of the nexmon framework in combination with firmware version 18.41.113 is in firmwares/bcm4375b1/18_41_113_sta. Again: Copy the nexmon patch of version 18.41.8.9 and adapt all patch and wrapper function addresses to match version 18.14.113. bindiff should be sufficient for that.

Is it easy to create a patch from an existing version? I tried taking nexmon/patches/18_41_8_9_sta and copying it to use as a template to build with 18.41.113's firmware, but it throws some errors even after changing the versions in some of the files.

Same answer as above.

[Yev-henii]

Please help me figure this out. I have successfully matched almost all the functions between firmware versions 18.41.8.9 and 18.41.8.117 using BinDiff in IDA Pro, except for one that I cannot find in the 18.41.8.9 firmware, but it is present in the local_wrapper.c file. Here it is:

AT(CHIP_VER_BCM4375b1, FW_VER_18_41_8_9_sta, 0x1FD9BC)
int
called_by_wlc_ioctl(struct wlc_info *wlc, int cmd, char *arg, int len)
RETURN_DUMMY

Also, I don’t understand how to find the values for definitions.mk for the 18.41.8.117 firmware version