yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] sordna:
Actually apart from lock/unlock the app also has a button to handle the tampered/untampered flag. Which would be good to set to untampered if it isn't.
[Samsung Galaxy Nexus] FredFS456:
Thanks, forgot about that because I have a Gnex, which doesn't have this 'feature'.
[Samsung Galaxy Nexus] jpjdlv:
Thanks both of you, the fact is that i locked my smartphone whit nexus root toolkit and when i checked my tampered bit was false, and i did not run the script.

That is why i was asking you.
[Samsung Galaxy Nexus] osm0sis:
Anybody got a Nexus 6 or 9 they want to experiment with? ;)
[Samsung Galaxy Nexus] Taomyn:
Any-one tried this on Lollipop yet?

I got my N5 upgraded but I haven't been brave enough to hit the "Lock" button yet to re-lock the boot loader that I unlocked before sideloading the OTA zip.
[Samsung Galaxy Nexus] osm0sis:
Looks like everything remains the same on existing devices, the big question will be the changes to how it's done on the new ones.
[Samsung Galaxy Nexus] Cheater912:
It stops working on the Nexus 6 right when I open it. Was looking forward to locking the bootloader with root :S
[Samsung Galaxy Nexus] osm0sis:
Huh? Support needs to be added by doing the appropriate research first. If you're volunteering then we need a partition list, to start with. :)
[Samsung Galaxy Nexus] Cheater912:
I'll dump the partitions and relock the bootloader if the developer is still around.
[Samsung Galaxy Nexus] osm0sis:
I helped crack the N10 and cracked the N7 '13 so you can send them to me if you like. :)

Obviously you need a custom recovery flashed, then dumps when it's relocked as well. :good:
[Samsung Galaxy Nexus] Cheater912:
Which partition is the unlock flag set in?
[Samsung Galaxy Nexus] brotbuexe:
Just be curious, is there still a benefit of locking the bootloader if you have encrypted storage?

I used it only for unlocking the bootloader before booting the twrp recovery (had only the stock recovery flashed and bootloader locked all the time) while not having encryption on 4.4.
[Samsung Galaxy Nexus] scary alien:
That's the purpose / intent of acquiring (and analyzing) the partition dumps.

:)
[Samsung Galaxy Nexus] Cheater912:
Here's the partition list:

aboot	/dev/block/mmcblk0p7
abootBackup	/dev/block/mmcblk0p13
boot	/dev/block/mmcblk0p37
cache	/dev/block/mmcblk0p38
cid	/dev/block/mmcblk0p29
ddr	/dev/block/mmcblk0p6
frp	/dev/block/mmcblk0p18
keystore	/dev/block/mmcblk0p24
kpan	/dev/block/mmcblk0p36
logo	/dev/block/mmcblk0p30
logs	/dev/block/mmcblk0p25
mdm1dhob	/dev/block/mmcblk0p28
mdm1hob	/dev/block/mmcblk0p27
mdm1m9kefs1	/dev/block/mmcblk0p19
mdm1m9kefs2	/dev/block/mmcblk0p20
mdm1m9kefs3	/dev/block/mmcblk0p21
mdm1m9kefsc	/dev/block/mmcblk0p33
metadata	/dev/block/mmcblk0p2
misc	/dev/block/mmcblk0p31
modem	/dev/block/mmcblk0p1
oem	/dev/block/mmcblk0p39
padA	/dev/block/mmcblk0p11
padB	/dev/block/mmcblk0p22
padC	/dev/block/mmcblk0p40
padD	/dev/block/mmcblk0p32
persist	/dev/block/mmcblk0p26
recovery	/dev/block/mmcblk0p35
rpm	/dev/block/mmcblk0p8
rpmBackup	/dev/block/mmcblk0p14
sbl1	/dev/block/mmcblk0p3
sbl1bak	/dev/block/mmcblk0p12
sdi	/dev/block/mmcblk0p4
sec	/dev/block/mmcblk0p5
sp	/dev/block/mmcblk0p23
ssd	/dev/block/mmcblk0p34
system	/dev/block/mmcblk0p41
tz	/dev/block/mmcblk0p10
tzBackup	/dev/block/mmcblk0p16
userdata	/dev/block/mmcblk0p42
utags	/dev/block/mmcblk0p9
utagsBackup	/dev/block/mmcblk0p15
versions	/dev/block/mmcblk0p17

Locking the bootloader factory reset my device. Tried it twice. Very strange...

I started reverse engineering the aboot partition, and it seems like it wipes the sp partition upon unlocking. Not sure why yet though.
[Samsung Galaxy Nexus] osm0sis:
Great! So excluding obvious impossible ones like system, cache, userdata, recovery and boot, can you perform dumps of all those partitions unlocked, and then again locked and upload them somewhere for me?
[Samsung Galaxy Nexus] steven676:
Absolutely -- if I can modify the software on your device, I can steal your encryption keys and/or data.
[Samsung Galaxy Nexus] brotbuexe:
Ok.

As i understand from the second post, all the unlocked flags are saved outside /data.

When I have a custom recovery flashed, anyone could unlock the bootloader without wiping by using the recovery?

So another security issue would be to have a custom recovery flashed? Regardless of having /data encrypted.

And aside the bootloader lock/unlock it should be possible to run a brute force attack for the pin to decrypt the /data as a script from within the custom recovery. :confused:

I guess I go back to have stock recovery flashed and run my phone in locked mode until I have to flash or backup anything from fastboot/customrecovery. Then I unlock via Bootunlocker from inside the system, go to fastboot and boot the twrp.img directly.

I had a feature request some months ago, maybe it is still in consideration. When I use this way, sometimes I forgot to lock the bootloader again.

It would be nice if bootunlocker have a setting to autocheck for lockstate when android starts and shows a notification if it isn't locked.
[Samsung Galaxy Nexus] sordna:
That would mean a start on boot permission and one more app to start when the phone boots :(

When you boot the phone and the bootloader happens to be unlocked, you do see an unlocked padlock icon, at the bottom of the Google screen, no? I see it every time so it's plenty indication for me.
[Samsung Galaxy Nexus] efrant:
I'm pretty sure I've mentioned this before, but having a locked bootloader doesn't really add any level of security at all on a Galaxy Nexus (and many other devices as well). Looking specifically at the GNex, it has been shown that you can easily unlock the bootloader without wiping using OMAPFlash. Moreover, you don't even need to unlock the bootloader to pull off the data -- OMAPFlash has direct access to the raw NAND, so any form of "security" (other than encryption) is pretty much useless.

Although I haven't seen any detailed how-to's, I believe QPST should have the same ability on Qualcomm devices.

As for encryption, I'm not too familiar with it, but I was under the impression that if you encrypt your data, you cannot easily decipher the encryption keys, so it should be secure, bootloader locked or not. That being said, when there's a will there's a way: look at this.
[Samsung Galaxy Nexus] drawde40599:
N6

Is it looking like the Nexus 6 is a possibility ?
[Samsung Galaxy Nexus] osm0sis:
Waiting on literally ANYBODY to follow my instructions above so I can get cracking..
[Samsung Galaxy Nexus] DylonSaaied:
Unlocking bootloader on nexus 4, rooted with towelroot.

Hi segv11, I have rooted my nexus 4 with towelroot, now if I want to unlock the bootloader with your app it won't wipe my data, and if I want to flash Android 5.0 with adb, I have to remove the -w parameter to not make it wipe my data. Will this all work? Because I dont want to factory reset it... :)
[Samsung Galaxy Nexus] steven676:
Indeed, the key is stored encrypted using your PIN or password. But if I can modify the software on your system, I can steal your PIN/password and use that to decrypt the key and your data. (This is the point of the dm-verity based secure boot that's required by Google for official Lollipop devices -- by preventing all modifications to the system partition, it prevents me from executing such an attack. Of course, that's not such a good thing if you like modifying your device ...)

Bottom line: if you can't prevent modification to the software on your phone, your data cannot be secure by definition. (Yes, that means that on devices where manufacturer or government tools can bypass bootloader locking, you have no security against anyone with those tools.)
[Samsung Galaxy Nexus] efrant:
Are you suggesting that if someone steals your device, he/she will be able to find out your PIN/password from the device itself? From my understanding, that wasn't possible, i.e., that if your device is encrypted, the PIN/password is cannot be found.

However, if you are saying that if someone steals your device, modifies the firmware, returns it to you so that you can enter your PIN/password, then yes, I'd agree. But then, we are talking about something different.
[Samsung Galaxy Nexus] steven676:
Well, you're not supposed to be able to get the PIN or password off the device regardless of whether the device is encrypted or not. (There has been work done on recovering PINs via methods like examining smudges on the screen, so I wouldn't bet a lot of money on that.)

That's the threat model I have in mind here. The question here is how much you think your attacker cares about your data -- your run-of-the-mill phone thief will probably just forget about the data when faced with this situation, but someone who goes to the trouble of stealing the phone specifically for its data is probably willing to install malware and ensure that the phone makes its way back to you. (If your threat model includes a government, you can even omit the "stealing the phone" step.)
[Samsung Galaxy Nexus] efrant:
So Google was nice enough to ship me my Nexus 6 today. :) [OT: It is indeed massive. :eek: Not sure if I'll be able to get used to it.]

os, did you get dumps of the partitions yet? If not, I'll try to pull them for you over the next few days.

But before I go ahead and unlock the bootloader, does anyone know how the developer option requirement (i.e., you have to enable unlocking from within Developer options in Android) works? It would be nice if I could get the initial dumps without having to enable that option, just to see what it actually does (and in case it trips a fuse or something). Has anyone heard of a root method without unlocking the bootloader for LRX22C?
[Samsung Galaxy Nexus] osm0sis:
Hey hey! Happy holidays! Nobody's been savvy/engaged enough to give me the dumps yet, so I'd definitely appreciate it. :cowboy:

Held the Nexus 6 at a Rogers store and decided it was too crazy large, so I hunted down a mint condition out-of-box Nexus 5 on eBay instead; set it up last night! ;) :D
[Samsung Galaxy Nexus] efrant:
I'm in the process of dumping the partitions as I type! I'll have to leave in about 30 mins, so I prob won't have time to upload them, but I will tonight.

I was able to unlock the bootloader without ever booting into Android. (However, I believe there is a tamper flag that we will have to look for as well.)

The N5 is a great phone. I still have mine, although the screen is cracked... :( If I can't fully get used to the size of the N6, I'll be selling it, and then back to the N5.

Happy holidays to you too! :cheers:
[Samsung Galaxy Nexus] efrant:
PM sent.
[Samsung Galaxy Nexus] osm0sis:
Well! That was pretty easy ;):

$ diff dumps-locked/ dumps-unlocked/
Binary files dumps-locked/sp.img and dumps-unlocked/sp.img differ

diff sp-locked.xxd sp-unlocked.xxd:

2,5c2,5
< 0000010: 0000 0000 0000 0000 0100 0000 f10e 42a2 ..............B.
< 0000020: 7b2e b66c 0000 0000 7373 745f 746f 6b65 {..l....sst_toke
< 0000030: 6e00 0000 0000 0000 0002 0000 0000 0000 n...............
< 0000040: 0004 0009 0000 0000 0000 0000 0000 0000 ................
---
> 0000010: 0000 0000 0000 0000 0000 0000 0b1d a51d ................
> 0000020: 2910 346c 0000 0000 0000 0000 0000 0000 ).4l............
> 0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................

65c65
< 0000400: 4e4b 4f54 0000 0000 002c b07a 5a00 1100 NKOT.....,.zZ...
---
> 0000400: 0000 0000 0000 0000 0000 0000 0000 0000 ................

67,68c67,68
< 0000420: 0000 0000 0000 0000 0000 0400 3c5f 47d6 ............<_G.
< 0000430: 023c d11e 71ce 6800 9a40 67a9 0000 0000 .<..q.h..@g.....
---
> 0000420: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> 0000430: 0000 0000 0000 0000 0000 0000 0000 0000 ................

Off to a good start. :cowboy:

My instinct is telling me it's either the 01 or the 02 in the top difference; weird though, since that'd mean they've gone back to having locked have a value, which hasn't been true since the Galaxy Nexus. You sure there's a tamper bit though? I don't see the boot.img-esque ANDROID! header that usually accompanies that.

Mind flashing your un/locked sp.img dumps whole to make sure it contains the change? Also, what's "fastboot oem device-info" output?
[Samsung Galaxy Nexus] efrant:
Nice! I'm willing to test.

No, I'm not sure there's a tamper bit... I just thought I read in a thread that someone noticed that the lock state status showed a different value when relocked vs. not having been unlocked.

I don't have access to a computer at the moment, but I'll get you the device-info output when I can.
[Samsung Galaxy Nexus] osm0sis:
Thanks! Much appreciated! This too in case you missed it. :)
[Samsung Galaxy Nexus] N4MI21:
one question in my mind

Unlocking bootloader by this app does not need computer ??
[Samsung Galaxy Nexus] efrant:
Haven't had the chance yet. Will post here as soon as I backup my data and flash the sp images.

It looks like you're right, as there is no "device-info" command.

Here is the output of "fastboot oem help" listing the "oem" commands:

C:\Android\Nexus 6>fastboot oem help
...
(bootloader) config...
(bootloader) fb_mode_set
(bootloader) fb_mode_clear
(bootloader) bp-tools-on
(bootloader) bp-tools-off
(bootloader) qcom-on
(bootloader) qcom-off
(bootloader) unlock
(bootloader) lock
(bootloader) get_unlock_data
(bootloader) cid_prov_req
(bootloader) read_sv
(bootloader) off-mode-charge
OKAY [ 0.016s]
finished. total time: 0.016s

Another thing to note is that aside from the standard menu items in the bootloader (Start, Restart bootloader, Recovery mode, Power off), there are five others: Factory, Barcodes, BP Tools, QCOM, and Bootloader logs. I haven't had the chance to play around with them yet. (This is also my first Motorola smartphone, so maybe some of them are Moto-specific.)
[Samsung Galaxy Nexus] efrant:
Confirmed. Flashing the locked sp.img re-locks the bootloader. Flashing the unlocked sp.img unlocks the bootloader. No bootloop, no wipe, no other issued that I've seen. So lock flag is indeed in the sp.img.
[Samsung Galaxy Nexus] osm0sis:
Awesome! So, since nobody else has stepped up to offer dumps, would you mind unlocking and locking a few more times, taking dumps each time so we can see if the other random data changes enough that we can narrow down the offset? :)
[Samsung Galaxy Nexus] efrant:
Don't mind at all. Let me know what you want. I should have time tomorrow.
[Samsung Galaxy Nexus] osm0sis:
Just sp.img dumps; one after oem unlock and lock, but do this twice. So 2 more examples of sp unlocked and locked I'm hoping to compare. :good:
[Samsung Galaxy Nexus] KreAch3R:
For anyone wondering, I can confirm that it works in Lollipop (5.0.2) for the Nexus 5 (32GB). Both locking the bootloader without wiping data and setting the untampered flag.

Specs:

Nexus 5 (32GB)
SimpleAOSP 5.0.2 rom
TWRP 2.8.1.x multirom recovery
BootUnlocker app version: 1.5.2 (google play)
Bootloader: HHZ12d
Baseband: M8974A-2.0.50.2.22
[Samsung Galaxy Nexus] efrant:
Have a look here. [MENTION=3082108]Milly7[/MENTION] provided his dumps as well.
[Samsung Galaxy Nexus] osm0sis:
Nice! That reduces some of the noise, but still leaves us with the same basic choices for offset:

cat diff-unified.txt:

2,5c2,5
< 0000010: 01 .
< 0000020: 7b2e b6 7373 745f 746f 6b65 {.. sst_toke
< 0000030: 6e 02 n .
< 0000040: 04 09 . .
---
> 0000010: 00 .
> 0000020: 2910 34 0000 0000 0000 0000 ).4 ........
> 0000030: 00 00 . .
> 0000040: 00 00 . .

65c65
< 0000400: 4e4b 4f54 2c 11 NKOT , .
---
> 0000400: 0000 0000 00 00 .... . .

67c67
< 0000420: 04 .
---
> 0000420: 00 .

The 01, 02, 04, or maybe even 09 in the first section, and 04 in the third are our top contenders. Care to take a stab at switching those out on the fly until we know which does it? Digging up the directions again now.
[Samsung Galaxy Nexus] osm0sis:
N6 Lock Offset Testing

Decimal Offset - Values (Locked/Unlocked):

24 01/00
57 02/00
65 04/00
67 09/00
1066 04/00

e.g to potentially lock using offset 1066:

offset=1066;
setstate=04;
block=/dev/block/platform/msm_sdcc.1/by-name/sp;
echo -ne "\x$setstate" | dd obs=1 count=1 seek=$offset of=$block;

Presuming you're unlocked you'll want to flip one (and only one at a time) to locked in recovery, reboot to bootloader to check, then reboot back to recovery and flip it back to unlocked if it didn't work.
[Samsung Galaxy Nexus] efrant:
[MENTION=4544860]osm0sis[/MENTION] Another set of images, courtesy of [MENTION=5039076]chef_christoph[/MENTION]
[Samsung Galaxy Nexus] osm0sis:
Same results. I don't think we need anymore dumps, they're not getting us any further. We just need someone to trial-and-error the 5 candidate offsets like I posted above. :good:
[Samsung Galaxy Nexus] efrant:
Will get on it as time permits. Thx.
[Samsung Galaxy Nexus] efrant:
Unless I did something wrong, I can't seem to get it to work.

I did this:

echo -n '\x01' | dd obs=1 count=1 seek=24 of=/dev/block/platform/msm_sdcc.1/by-name/sp

rebooted, still unlocked. I then reversed it, and did this:

echo -n '\x02' | dd obs=1 count=1 seek=57 of=/dev/block/platform/msm_sdcc.1/by-name/sp

rebooted, still unlocked. I then reversed it, and did this:

echo -n '\x04' | dd obs=1 count=1 seek=65 of=/dev/block/platform/msm_sdcc.1/by-name/sp

rebooted, still unlocked. I then reversed it, and did this:

echo -n '\x09' | dd obs=1 count=1 seek=67 of=/dev/block/platform/msm_sdcc.1/by-name/sp

rebooted, still unlocked. I then reversed it, and did this:

echo -n '\x04' | dd obs=1 count=1 seek=1066 of=/dev/block/platform/msm_sdcc.1/by-name/sp

rebooted, still unlocked. I then reversed it.

Did I miss something? I'll try it again to double-check at some point later on.
[Samsung Galaxy Nexus] osm0sis:
At a glance, looks like you missed that it was echo -ne, not echo -n. You also used ' instead of ". You might have written some junk data to your sp partition by mistake in doing so, so you might want to flash one of your dumps again. :eek:

When you're up to trying again, just cut and paste my code snippet into adb shell, replacing the offset and setstate numbers as appropriate first. Much safer and tried and true since it's directly out of my script. :good:
[Samsung Galaxy Nexus] efrant:
I'll do what you suggest. (Although what I had done is exactly how I did it for previous devices, i.e., using -n, not -ne, and using ' and not "...)
[Samsung Galaxy Nexus] osm0sis:
Hmm interesting. Not sure then. I'll wait to hear back after your next attempt, but it could very well be that it's one of the other, weirder-valued offsets, or, even crazier, a combination of a few.

Edit: I'm curious about the oem get_unlock_data and oem sp_test commands I've seen mentioned too if you're feeling brave. :)

[MENTION=4551856]segv11[/MENTION] you're the master here, any thoughts?

[MENTION=1566190]efrant[/MENTION] add 1033 2c/00 and 1038 11/00 to the list for your next attempt please. :good:
[Samsung Galaxy Nexus] efrant:
Will do.
[Samsung Galaxy Nexus] efrant:
C:\android>fastboot oem sp_test
...
(bootloader) command restricted
FAILED (remote failure)
finished. total time: -0.000s

C:\android>fastboot oem get_unlock_data
...
(bootloader) This command is not needed to unlock. Run fastboot oem
(bootloader) unlock directly.
OKAY [ 0.000s]
finished. total time: 0.016s

The oem sp_test result tells me that our bootloader is not fully unlocked. I hate being restricted... Need to get a hold of one of those engineering bootloaders... :D
[Samsung Galaxy Nexus] segv11:
I've been off XDA for a while, dealing with schoolwork.

I just got Android Studio installed on my computer (had Eclipse+ADK on my old box), so I can import the project.

I'm hoping to add new devices (like N6 and N9) if we can figure out the bits... but first I need to catch up on this thread. ;)

EDIT: After review, it looks like we are close on N6: if flashing the whole partition works, and we have dumps from multiple devices, this should be do-able. If we need to WRITE in multiple places to unlock, that should be feasible, through it would be good if I could get away with only READING one to display the lockstate in the app...

Another thought: is anyone interested in using the Play Store alpha/beta channels for testing (and thus setting up a Google Group or g+ community), or are we happy with posting APKs here?
[Samsung Galaxy Nexus] segv11:
I'm going to work on importing the app into Android Studio so I can build a new version. While we are working on N6 support, I would be happy to add Oneplus One if you are still willing to test. To test the tamper flag, you will need fastboot oem device_info to check bootloader's view of the tamper state.
[Samsung Galaxy Nexus] Polarfuchs:
Yes, just guide me through the things I need to do.
[Samsung Galaxy Nexus] segv11:
You posted the locations earlier. Once I have a test version, I'll upload the APK for you to try.
[Samsung Galaxy Nexus] osm0sis:
Seems pretty straightforward to know if it's unlocked, even if we do have to write a few spots to relock, since basically that whole section I outlined gets zeroed when unlocked. Hopefully one of the 7 candidates works, and if not then maybe [MENTION=1566190]efrant[/MENTION] can change all 7 to locked to see if that'll work where each alone doesn't (and hopefully avoid all the other changes).

I'm good with keeping the APKs here. You might need a Material redesign of the logo however. :p
[Samsung Galaxy Nexus] segv11:
What's the codename of your device? If you don't know it, you can find in by looking for ro.product.device in your /system/build.prop, or running "getprop ro.product.device" from a shell on the phone.

Also, can you verify that you have a way to check the bootloader's view of the tamper flag, before I include that in the build?
[Samsung Galaxy Nexus] segv11:
That's on my to-do list; I would find it convenient as well. However it is a fairly low priority.
[Samsung Galaxy Nexus] segv11:
Never mind the previous questions; I found answers to them on your other XDA threads.

Try this APK: https://drive.google.com/file/d/0B6qHcVHPO4VrNHE1eTlLeXh6dGc/view?usp=sharing

(Google Code no longer hosts new downloads; so I need to store them in Google Drive.)

This is a new build using Android Studio. There are two substantive changes:

- OnePlusOne should be supported (bacon or A0001)

- Should no longer crash on unsupported devices (that was a silly bug), but rather display the "unsupported device" error.

However, because this is a build in a new environment, I would encourage everyone to test it with devices that have been supported for a while (maguro, toro, toroplus, manta, mako, hammerhead, flo, and deb) to make sure that nothing is broken.

The package name is unchanged, but the class name of the main activity is changed, which means that if you have homescreen shortcuts or you have it filed into a specific screen in your app drawer (in a custom launcher) you will need to re-do these shortcuts.

Once we are satisfied that this is stable on all supported devices, I can either publish to the play store, or wait until I can support N6 if we're close.
[Samsung Galaxy Nexus] osm0sis:
maguro, flo and hammerhead are all good (so should be toro, toroplus and deb since their bootloaders match their counterparts). :good:

We're close on shamu, it's just a matter of figuring out which change(s) will be needed.
[Samsung Galaxy Nexus] Polarfuchs:
Oneplus One doesn't get recognized in the app if it isn't rooted at least.

So this app needs root access and you once must oem unlock (including a wipe).

If that is correct I will backup my data and then I can test it on the Oneplus One.
[Samsung Galaxy Nexus] segv11:
Toro, mako, and manta also good.
[Samsung Galaxy Nexus] segv11:
The app does need root to work, since it is writing to the aboot partition. (It would be scary if a non-root app could scribble all over your bootloader :o ). After that, it should recognize A0001 as OnePlus One
[Samsung Galaxy Nexus] Polarfuchs:
It is interesting that it shows tampered in fastboot oem device-info although I'm still totally stock and unrooted. The only changes I made was enabling developer options and enabling usb debugging. Will report back after rooting, then.