lineageos – How to install a post-market operating system on a Samsung Galaxy S7 with a broken screen that has “OEM unlock” still disabled?

I want to use my old Samsung Galaxy S7 (with a broken screen) as a headless device in my home network.

(Rationale – for the curious readers: Even with a broken screen it could possibly become a Bluetooth audio receiver (A2DP sink) or a CCTV-like device. And with its multiple CPU cores, I could even make it part of my home Kubernetes cluster to crunch some CPU-intensive tasks. This way it can remain of service in its afterlife.)

To prepare the device, I would either like to install PostmarketOS or Lineage OS on it. The installation procedures for both operating systems require installing/flashing TWRP onto the recovery partition. (Installation guides: Lineage OS; PostmarketOS)

Unfortunately, the device has most likely never been OEM unlocked before the screen broke. Based on my reading so far, this seems to be a pre-requisite for any kind of image flashing. At least, this is the most likely reason to me why all my flashing attempts failed. (See below what I’ve tried.)

Since the screen is broken, I cannot enable “OEM unlock” via the normal user interface-based procedure.

Now my questions are:

  1. Is “OEM unlock” being enabled a pre-requisite for flashing custom images onto my Samsung mobile device?
  2. How do I enable “OEM unlock” without having access to the device’s screen?

Since I’m not too attached to the device, I’m really willing to go far in experimentation. Any data on the device has most likely become inaccessible in my previous flashing attempts already (I cannot check with a broken screen), so keeping data is not a concern. I’m also willing to cut an USB cable open to solder myself an USB/UART connector cable if necessary.


Here’s what I’ve already tried:

1. Directly using PostmarketOS’s flasher functionality (which uses Heimdall), i.e. without using TWRP

pmbootstrap init
    (I cut the output of the installation wizard)

pmbootstrap install
    (I cut some of the output)
    (17:06:59) (native) format /dev/installp1 (boot, ext2), mount to mountpoint
    (17:06:59) *** (4/4) FILL INSTALL BLOCKDEVICE ***
    (17:06:59) (native) copy rootfs_samsung-herolte to /mnt/install/
    (17:07:07) (native) make sparse rootfs
    (17:07:13) *** FLASHING INFORMATION ***
    (17:07:13) Run the following to flash your installation to the target device:
    (17:07:13) * pmbootstrap flasher flash_rootfs
    (17:07:13)   Flashes the generated rootfs image to your device:
    (17:07:13)   /home/hauke/.local/var/pmbootstrap/chroot_native/home/pmos/rootfs/samsung-herolte.img
    (17:07:13)   (NOTE: This file has a partition table, which contains /boot and / subpartitions. That way we don't need to change the partition layout on your device.)
    (17:07:13) * pmbootstrap flasher flash_kernel
    (17:07:13)   Flashes the kernel + initramfs to your device:
    (17:07:13)   /home/hauke/.local/var/pmbootstrap/chroot_rootfs_samsung-herolte/boot
    (17:07:13) * If the above steps do not work, you can also create symlinks to the generated files with 'pmbootstrap export' and flash outside of pmbootstrap.
    (17:07:13) NOTE: chroot is still active (use 'pmbootstrap shutdown' as necessary)
    (17:07:13) Done

pmbootstrap flasher
    (17:09:09) (native) flash rootfs image
    (17:09:11) (native) install
    < wait for any device >
    Heimdall v1.4.2
    
    Copyright (c) 2010-2017 Benjamin Dobell, Glass Echidna
    http://www.glassechidna.com.au/
    
    This software is provided free of charge. Copying and redistribution is
    encouraged.
    
    If you appreciate this software and you would like to support future
    development please consider donating:
    http://www.glassechidna.com.au/donate/
    
    Initialising connection...
    Detecting device...
    Claiming interface...
    Setting up interface...
    
    Initialising protocol...
    Protocol initialisation successful.
    
    Beginning session...
    
    Some devices may take up to 2 minutes to respond.
    Please be patient!
    
    Session begun.
    
    Downloading device's PIT file...
    PIT file download successful.
    
    Uploading SYSTEM
    11%
    ERROR: Failed to confirm end of file transfer sequence!
    ERROR: SYSTEM upload failed!
    
    Ending session...

2. Trying to flash TWRP using Heimdall

heimdall flash --verbose --no-reboot --RECOVERY twrp-3.5.0_9-0-herolte.img
Heimdall v1.4.1

Copyright (c) 2010-2014 Benjamin Dobell, Glass Echidna
http://www.glassechidna.com.au/

This software is provided free of charge. Copying and redistribution is
encouraged.

If you appreciate this software and you would like to support future
development please consider donating:
http://www.glassechidna.com.au/donate/

Initialising connection...
Detecting device...
      Manufacturer: "SAMSUNG"
           Product: "Gadget Serial"

            length: 18
      device class: 2
               S/N: 0
           VID:PID: 04E8:685D
         bcdDevice: 021B
   iMan:iProd:iSer: 1:2:0
          nb confs: 1

interface(0).altsetting(0): num endpoints = 1
   Class.SubClass.Protocol: 02.02.01
       endpoint(0).address: 83
           max packet size: 0010
          polling interval: 09

interface(1).altsetting(0): num endpoints = 2
   Class.SubClass.Protocol: 0A.00.00
       endpoint(0).address: 81
           max packet size: 0200
          polling interval: 00
       endpoint(1).address: 02
           max packet size: 0200
          polling interval: 00
Claiming interface...
Setting up interface...

Initialising protocol...
Protocol initialisation successful.

Beginning session...

Some devices may take up to 2 minutes to respond.
Please be patient!

Session begun.

Downloading device's PIT file...
PIT file download successful.

Uploading RECOVERY
0%
2%

(...)

98%

100%
ERROR: Failed to unpack received packet.

ERROR: Failed to confirm end of file transfer sequence!
ERROR: RECOVERY upload failed!

Ending session...
ERROR: libusb error -7 whilst sending bulk transfer. Retrying...
ERROR: libusb error -7 whilst sending bulk transfer. Retrying...
ERROR: libusb error -7 whilst sending bulk transfer. Retrying...
ERROR: libusb error -7 whilst sending bulk transfer. Retrying...
ERROR: libusb error -7 whilst sending bulk transfer. Retrying...
ERROR: libusb error -7 whilst sending bulk transfer.
ERROR: Failed to send end session packet!
Releasing device interface...

3. Trying to flash TWRP via Odin

Output log:

<ID:0/011> Added!!
<ID:0/011> Odin engine v(ID:3.1401)..
<ID:0/011> File analysis..
<ID:0/011> Total Binary size: 43 M
<ID:0/011> SetupConnection..
<ID:0/011> Initialzation..
<ID:0/011> Get PIT for mapping..
<ID:0/011> Firmware update start..
<ID:0/011> NAND Write Start!! 
<ID:0/011> SingleDownload.
<ID:0/011> recovery.img
<ID:0/011> FAIL!
<ID:0/011> 
<ID:0/011> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

I also tried flashing original Samsung firmware onto my device, also using Odin. That resulted in a “success” message, making me believe that my ROM is not fried (yet).


A similar question with a more narrow focus had already been posted back in 2016. Back then, the answer was “there’s no public knowledge how to do this”. Since the scope of that other question was focused on a way to enable “OEM unlock” through the modification of a file, I have created this new question with broader goal in mind.