During our previous research on Android File-Based encryption, we studied the boot chain of some Samsung devices based on Mediatek system on chips. Our objective was to exploit a known boot ROM vulnerability to bypass the secure boot and ultimately retrieve the required ingredients to brute force the user credentials. Once we became familiar with this boot chain, we decided to take a closer look at a component coming later in the process: the Little Kernel bootloader (LK, also called BL3-3).We begin our bug-hunting journey in LK from a jpeg parser that was introduced by the vendor. Then we will show how, thanks to reverse engineering and fuzzing, we discovered two vulnerabilities leading to code execution in the context of the bootloader, and how they can be used to bypass the secure boot and take full control over the Android system.In order to trigger these vulnerabilities, we need a way to flash our jpegs on the flash memory of the device. We will dive into the implementation of Odin, the Samsung recovery protocol and present a vulnerability we discovered, allowing us to write anything on the flash memory without authentication.Finally, we will focus on the ARM Trusted Firmware (also known as the secure monitor), which runs with the highest privileges on the device. We will present two critical vulnerabilities we discovered and show how they allowed us to break the last security barrier of this device to leak the secrets hidden in the secure world.