yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] efrant:
Please read this post: http://xdaforums.com/galaxy-nexus/t...r-nexus-devices-version-t1731993/post27878644
[Samsung Galaxy Nexus] osm0sis:
Did some dumps of my girlfriend's 5X but unfortunately don't have free license to test out flipping bytes for her fear of bricking it. :(

lockstate is definitely on the misc partition, but there might be repeating data/hashes again though so I'm not sure if it'd work.

Some candidate 00/01 flips I found though:

/dev/block/platform/soc.0/f9824900.sdhci/by-name/misc

237561

241761

241769

And the allow oem unlock should be in persist partition as mentioned in build.prop but it actually changed a lot of partitions, namely metadata, modemst1 and st2 and persistent, in addition to persist.. There were way too many 00/01 changes in persist to narrow down when I looked, so no dice there until maybe we get a few more dumps to help narrow things down.

Edit: @ mention me if someone ends up wanting to help test these out or provide more dumps. :good:
[Samsung Galaxy Nexus] lePoMo:
just thought I'd confirm that BootUnlocker still works on a Nexus 5 with Marshmallow (and systemless root).

(admittedly there's no reason why it shouldn't, but google's device-agnostic way of talking about verity had me unsecure about what could happen with a locked bootloader when there's a modified boot partition)
[Samsung Galaxy Nexus] TheDannemand:
Great points. I've been using it with MM as well and didn't even give thought to that. I guess there was a risk it could have messed something up - or just not worked.

As it turns out, it still works perfectly. This is one of the most useful apps imaginable for Nexus devices.
[Samsung Galaxy Nexus] Xoib:
Hello, can I help you to integrate the rights position in boot sector to target the OnePlus X ?
[Samsung Galaxy Nexus] RusherDude:
So this died definitely with the appareance of the "enable OEM unlock" option in the settings. :(

A shame, one of the greatest tools there ever was for N5 and such.
[Samsung Galaxy Nexus] bigrammy:
Amazon Fire Phone msm8974 Bootloader=URSA

EDIT: WARNING!!!! Phone is now a paperweight so be careful messing with boot0 and aboot :laugh:

As you may or may not know the Amazon Fire Phone has a locked bootloader with no sign of Amazon releasing a unlock code :mad:

So we are kind of stuck in terms of any fully fledged development on this now super cheap flagship phone. :(

Thanks to [MENTION=5749760]ggow[/MENTION] great work on this phone we do have some development here http://xdaforums.com/fire-phone :good:

It would be great to unchain this Phone so things could move on. :rolleyes:

Thankfully I happened on this thread and [MENTION=4544860]osm0sis[/MENTION] thread while searching for info about unlocking bootloaders. :victory:

Using the info gathered from this and osm0sis's thread I began to experiment on the aboot which looks like this

So as we can see something is resetting the Locked/Unlocked flag :rolleyes:

Since we cannot compare Locked/Unlocked state it kinda makes it difficult to find what is responsible for the rewrite of the aboot partition. :confused:

I suspect the boot0 is culprit and wondered if anyone has a before and after of their boot0 if it looks similar to mine that is ??

As you can see I am thinking 04 = off/locked and maybe 08 = on/unlocked :eek:

Any thoughts info or help would appreciated. :fingers-crossed:

PS: Android Version is KK4.4.4 so no "Allow oem Unlock" in settings.
[Samsung Galaxy Nexus] RusherDude:
Well I will have to repeat thist post cause the xda premium didnt post it apparently -.-.

--

[MENTION=3924647]bigrammy[/MENTION] very interesting post! If the aboot partition is being rewritten every single time after boot, and it means that some deeper bootloader stage (or even maybe some hardware routine and nothing can be done against this), then this scenario is pure hell. A shame you bricked that when trying to modify the boot0 partition :P, I hope you got jtag or something, because you seem skilled playing with bootloaders :P.

PS: Shouldn't you censor the Product ID on your images?

[MENTION=1143630]osmosis[/MENTION] now that I though, why got the development of bootunlocker stopped? I don't understand why the "OEM Unlock" option in developer settings is stopping the development of bootunlocker, when in the normal use case of this tool, the user would be rooted and then he would have access to both the bootloader (params?) partition with the bits to change and the other partition with the OEM unlock setting, which was changed via TWRP on the Nexus 6 brick scenario when it came out.

Couldn't this tool keep being developed for some reason? it would even be more impotant than before, offering an option for example to force a value on the oem unlock bit, so people can freely lock their phones without fearing the value to disable and lock you into a nightmare..

In my N5X, I miss this and multirom. But multirom is being developed it seems so let's hope it moves on but this.. is a heartbreak to see this abandoned :'(

Thanks a lot for your efforts!!
[Samsung Galaxy Nexus] bigrammy:
Just for info :o

What i did was look at a stock OTA which flashed the aboot "emmc_appsboot.mbn" in Hexedit it showed loads of the stuff I saw in boot0 which I highlighted in my screenshot above. :eek:

From my expensive research and inexperience :laugh: I can tell you that the "boot0" can be updated from the "aboot" don't ask me how or why but it does. This must be ARM level stuff that's happening here all I know is the "emmc_appsboot.mbn" had a sh*t load more stuff than my dd of that partition which was already up to date so it seems that they update boot0 via aboot :eek:

As for my Product ID I am not sure what can be done with this other than they have a Amazon phone but let me know if it's unique and the crims can do anything with it and I will remove it asap but for the time been it's a brick. :confused:
[Samsung Galaxy Nexus] RusherDude:
Well, for my even more massive inexperience and just curiosity-level on bootloaders stuff, all the bootloader "software" partitions seem to get updated when the bootloader does, not only aboot/hboot/etc. Same happens for others like pbl/rpm, sbl, tz etc. So I don't find strange than the OTA is updating boot0 from aboot, is like when on fasboot mode (aboot) you flash a bootloader, you actually overwrite all the bootloader partitions (tho not at that point but after the check and reboot bootloader). Unless I'm very off the problem here, which could easilly be the case lol hahahaha. Please correct me if Im wrong :fingers-crossed:.

About product ID, I have no idea if anything can be done with this, but its never a good idea to give away something unique that identifies a device just incase later you regret it. Imagine that in a year amazon gives you an unlock bootloader code one single time per product ID, someone could ruin it for you :P, just a scenario haha.

Thanks a lot for the details, very interesting stuff! :good:

Edit: correction was mixing hboot with boot0 at one point.
[Samsung Galaxy Nexus] bigrammy:
Hi

This stuff is way above my pay grade bro and I can only deduce and share this because when I edited the "emmc_appsboot.mbn" with my "ON" (08) values and flashed it the phone totally freaked out and bricked. :laugh:

I still had access to the partitions using linux which showed the dev blocks /dev/sdb* so I dd them with the stock firmware from the OTA but that didn't work and ended up killing it altogether no idea why maybe the order in which I flashed them :eek:

No Amazon flashtool is available or the phone would have been recoverable I am sure but they left us in the cold with that so it's try it and see what happens time :cowboy:

Anyway lesson learned. :laugh:

PS: Product id is 0 The info you see is my bt-mac-address (bluetooth) :laugh: but thanks for the heads up. :good:
[Samsung Galaxy Nexus] RusherDude:
No unlock code, no tool.. what a waste of device :P.

And you have reason about product ID :laugh:
[Samsung Galaxy Nexus] osm0sis:
I got N5X support research started a few pages back, but nobody volunteered any more dumps, so there wasn't any way to narrow down the addresses of the lockbit or oembit. If you want to help out, dumps of the 2 partitions I mentioned, locked and unlocked, several times over would probably go a long way toward completing my work.

Too labor intensive is one of the main problems.. Not sure I have time for analysis at the moment, so if someone else could help there that would be good too. An app like this needs a team. :)
[Samsung Galaxy Nexus] RusherDude:
I honestly have no time right now to be testing unlocking and locking the device (less if we can't evade the wipes :( ), if I get some soon I will try to get into it, because bootunlocker deserves it :p.

You were talking about misc (/dev/block/mmcblk0p23) and persist (/dev/block/mmcblk0p24) right? you also mention changes in metadata, modemst1 and st2 and persistent.. wouldn't you need those too? does it make sense changes in modemst1 and modemst2 on unlocking??

By the way, I've been reading the N6 episode and I see that there was no success, despite having a lot of dumps, because all of them concluded to the same differences and it seems that the N6 had different bootloader status including hashes or whatever, a pain.

Do you think that N5X will be as easy as N4/N5 to find these flip bits, or that the oem unluck episode didn't only add that requirement for unlocking, but also made everything work with hases or ****?

Btw, I checked and my N5X appears as unlocked but not tampered (also with an empty display panel option?):

fastboot oem device-info
...
(bootloader)	Device tampered: false
(bootloader)	Device unlocked: true
(bootloader)	off-mode-charge: true
(bootloader)	Display panel:
OKAY [ 0.043s]
finished. total time: 0.043s

Is this normal? shouldn't it appear as tampered since I unlocked the BL? at least I remember my N5 shown tampered status asap I unlocked it.
[Samsung Galaxy Nexus] osm0sis:
No idea about the tampered status, it was always kind of unclear what tripped it on a Nexus.

misc and persist should be all we need, I was just noting that it's a little worrisome for oembit toggling that so many other partitions also got altered. There's also the possibility that misc has hashes that would keep us from toggling, but more dumps and testing should reveal that for certain.
[Samsung Galaxy Nexus] osm0sis:
[MENTION=4551856]segv11[/MENTION], may as well add OnePlus X support: http://xdaforums.com/oneplus-x/help/guide-unlock-bootloader-oneplus-x-using-t3362640 ;)

Good work [MENTION=5301049]Titokhan[/MENTION]!
[Samsung Galaxy Nexus] SkandaH:
Thanks! :highfive:

Don't forget the Zuk Z1. :D
[Samsung Galaxy Nexus] osm0sis:
[MENTION=2861395]jesssiii[/MENTION], I'll reply here so we're in the right spot. ;)

Well.. pretty similar to the N5X (and N6 and N9..) we need partition dumps of all the non-system/data/cache/radio blocks when both locked and unlocked to compare and find what byte gets flipped to control the bootloader lockstate. Also, the fastboot oem "unlockability" state (which is in Developer Options when booted). You able to help? :D

I'm also wondering if [MENTION=5301049]Titokhan[/MENTION] might be willing to help with comparing the dumps since he appears to have successfully worked out a couple of other devices?
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4544860]osm0sis[/MENTION]

No problem! I'm trying to get my hands on a Nexus 5X/6P too.

Regarding this app, is there someone who can continue the development?

:confused:
[Samsung Galaxy Nexus] osm0sis:
I think [MENTION=4551856]segv11[/MENTION] may still pop up and add devices, since he continued to thanked a few of my posts in the recent past here.

Otherwise, the code is available, so someone could always start rolling their own updated version. For now I'm hoping he can move the code to GitHub and we can start making pull requests to update it like people did with AdAway.
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4544860]osm0sis[/MENTION]

Well, that's relieving :angel:

Wait, looks like he already moved it: https://github.com/segv11/boot-unlocker
[Samsung Galaxy Nexus] efrant:
Not sure if there is any interest in adding non-Nexus/OnePlus devices, but in case there is, here is some info for the HTC One M9:

S-OFF is a prerequisite.

To unlock bootloader: echo -ne "HTCU" | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

To lock bootloader: echo -ne '\x00\x00\x00\x00' | dd of=/dev/block/mmcblk0p2 bs=1 seek=33796

To disable write remaining write protections following S-OFF: echo -ne '\x04' | dd of=/dev/block/mmcblk0p32 bs=1 seek=4126

To revert tamper flag, i.e., revert software status to "original": echo -ne '\x00' | dd of=/dev/block/mmcblk0p8 bs=1 seek=4228100

Source:

http://xdaforums.com/one-m9/general/how-to-lock-unlock-bootloader-htcdevs-t3092036

http://xdaforums.com/one-m9/general/how-to-disable-remaining-write-t3171735
[Samsung Galaxy Nexus] SkandaH:
Great! Looks like we need to restart the 'war', possibly before the 'Civil War'.

;)
[Samsung Galaxy Nexus] osm0sis:
Just re-researching what we'd tried before here, and yeah, N6 might still be out based on this :(, but maybe if we can accommodate both unlocked states or something we could at least try again? :good:

[MENTION=5039076]chef_christoph[/MENTION], did you ever get any further with your investigations?

I'm fairly certain we also never really learned one way or the other about the N9.
[Samsung Galaxy Nexus] dechronic:
[MENTION=4544860]osm0sis[/MENTION]
[MENTION=5301049]Titokhan[/MENTION]

I have just got a Nexus 5x for myself but I won't get my accessories until the end of June (long story) so I can make dumps of it, etc. until then as I don't like my phones naked. I am leaving it to fully charge overnight but then I can go through the process of making the dumps in the locked and unlocked states tomrrow. I can check the hashes of the files when they are created as well. I read the initial steps at http://xdaforums.com/showpost.php?p... with the OEM unlocking enabled.
Sounds good?
[Samsung Galaxy Nexus] dechronic:
[MENTION=4544860]osm0sis[/MENTION]

It seems the OEM unlock option in the Development settings is written to the last byte of the persistent partition according to this info I found below while trying to follow the source code

Will post with anything else I find.

https://android.googlesource.com/pl...gs/+/ce249fe38ddf8da562a0e92c58a7bb216a23c0bb
[Samsung Galaxy Nexus] osm0sis:
This ought to do the trick for pretty much any device we care about going forward:

state=locked;
outdir=/sdcard/dumps;

if [ -e /dev/block/platform/*/by-name ]; then
target=/dev/block/platform/*/by-name;
elif [ -e /dev/block/platform/*/*/by-name ]; then
target=/dev/block/platform/*/*/by-name;
fi;
if [ "$target" ]; then
target=`echo -n $target`;
mkdir $outdir;
echo $target > $outdir/targets.txt;
bootdev=/dev/block/bootdevice/by-name;
test -e $bootdev && echo $bootdev >> $outdir/targets.txt;
for part in $(ls $target); do
case $part in
system|APP|cache|CAC|userdata|UDA|boot|LNX|recovery|SOS) ;;
*) dd if=$target/$part of=$outdir/$part-$state.img;;
esac;
done;
fi;

Change the state=locked to match the lockstate you're making dumps for (for filenaming purposes) and copy/paste to adb shell. :good:

Edit: It now also automatically echoes the found target by-name directory found in platform and the existence of a /dev/block/bootdevice/by-name, (a symlink/hardlink to the platform version found on newer devices to make them more standardized), out to targets.txt in the dumps directory.

[MENTION=4551856]segv11[/MENTION]
[Samsung Galaxy Nexus] osm0sis:
Yup. Thanks for volunteering, by the way! :highfive:
[Samsung Galaxy Nexus] dechronic:
I will start it tomorrow...gotta get some sleep, it's now 1:45am for me...when I get the images I will do a binary comparison to find the hex values that change as well if that helps.
[Samsung Galaxy Nexus] dechronic:
no differences between locked and unlocked for the follwoing partitions

Data removed

I have found the differences to change the oem unlocking toggle in developer mode. I will share later. Do you want that info as a PM?

I have tested it by making sure oem unlocking was disabled and then used dd to replace the partition with the backup with oem unlocking enabled. I booted and it showed it as being enabled and then I was able to lock the phone.

The partitions that show changes are:

Data removed

Method: I used TWRP to use adb to make and pull the images.

Note: When locking and unlocking the bootloader calls recovery partition so as to format the data partition, this forces it to boot into TWRP.

My initial test involved booting into the OS but this gave a 53MB file of changes.

I have now narrowed it down to two required partitions and their changes.... do you still want all of the partitions that I made a backup of?

---------- Post added at 05:21 PM ---------- Previous post was at 04:44 PM ----------

I also realized that even if the phone is locked and it has twrp and/or is rooted you will still get a prompt that the phone was modified on intial boot. That is something I guess we can't get away from as I assume the check is done by the bootloader....I won't mess with the bootloader unless I know of a way to reflash the bootloader in case brick the phone while testing...
[Samsung Galaxy Nexus] efrant:
That warning is because root modifies the boot image, and the bootloader verifies the boot image when the phone starts up.

It's possible to remove it if you want, but there's no real point.
[Samsung Galaxy Nexus] segv11:
I'm back, and I'll be checking this thread regularly if you have any issues/questions.

I'm thinking of flashing the JB pre-release from I/O, but since I have a toro I have to get a ported version rather than the official pre-release ROM. I may not do this right away so that I can make sure I'm flashing a stable and stock-ish JB ROM, but either way I intend to support both ICS and JB once I have a JB GNex to work with.

I see 71 active device installs; I hope the app is working well for all of you.

Although I'll be checking this thread regularly to support the app, development for new features and enhancements in the app is going to be fairly slow over the next few weeks. If a major problem comes up though, I'll try to fix it quickly.

>>> Hey Apple! I'm still enjoying hacking on my BANNED G-NEX! <<<
[Samsung Galaxy Nexus] segv11:
Google Play Developer Console

The Developer Console shows me the following active device installs for the app:

Android 4.0.3 - 4.0.4: 73 39.67 %
Android 4.0 - 4.0.2: 10 5.43 %
Others: 101 54.89 %

Since the Manifest requires a minimum of API 14 (Android 4.0), I have to assume that the "Others" are Jelly Bean. That leaves me wondering:

1) Since JB has been officially released (I/O attendees received it, and OTA is rolling to yakju and tajku), why does the Developer Console not identify JB users as "Android 4.1 - 4.1.1"?

2) This means about 100 of you (more than half) are using this on JB. Since I've not flashed JB yet, I please let me know whether it is working well for you.
[Samsung Galaxy Nexus] efrant:
Works great on 4.1 and 4.1.1!
[Samsung Galaxy Nexus] Technical:
Fantastic tool

Well, this is a MUST HAVE tool to keep security and flexibility. Thanks.
[Samsung Galaxy Nexus] blackout23:
I'm using with 4.1.1 which came OTA with my yakju GNEx. Worked like a charm. Had to get out and start the app again to

see the changed status after locking it but that's no problem. Thank you for this tool.
[Samsung Galaxy Nexus] segv11:
Thank you for the bug report: this is a race condition that I thought I fixed in the current version. I have reopened Issue 12 in Google Code, and will investigate.

BTW, if this occurs, changing the device orientation would also have forced an update.
[Samsung Galaxy Nexus] Meep70:
What would it take to make this work on a toroplus?
[Samsung Galaxy Nexus] efrant:
I think a good start would be to get segv11 two dumps of your param partition: one when your bootloadwr is locked, and one when it is unlocked. That should be all it takes, and then I have no doubt segv11 will be able to make sure it is fully compatible.
[Samsung Galaxy Nexus] segv11:
Efrant's got it right. I want to make sure that toroplus works the same way as toro and maguro. To do that we need to do a few things. You will need to have root, working adb and fastboot drivers, and be willing to mess around in the shell. There is a risk that if it doesn't work at all you will lock your phone and have to unlock it with "fastboot oem unlock", which would wipe data.

1) With your bootloader unlocked, get a root shell dump the param partition:

adb shell
su
dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/param of=/sdcard/param.unlocked.img
exit
exit

2) Relock your bootloader, and boot back into android:

adb reboot-bootloader
(Wait for bootloader to start. Check that it shows UNLOCKED.)
fastboot oem lock
(Look at bootloader, check that it shows LOCKED.)
fastboot reboot

3) With your bootloader now locked, get a root shell dump the param partition:

adb shell
su
dd if=/dev/block/platform/omap/omap_hsmmc.0/by-name/param of=/sdcard/param.locked.img
exit
exit

4) Zip up these img files (they're mostly small and compress well) and PM them to me or post them (note that they do not contain your IMEI, but they may contain your WiFi MAC Address).

adb shell
cd /sdcard
zip params.zip param.*.img
exit
adb pull params.zip .

5) At this point, your bootloader is locked. Flash back the unlocked param to make sure that it unlocks your phone. Otherwise we have trouble.

adb shell
su
dd if=/sdcard/param.unlocked.img of=/dev/block/platform/omap/omap_hsmmc.0/by-name/param
exit
exit
adb reboot-bootloader
(Wait for bootloader to start. Check that it shows UNLOCKED.)

Let me know what happened when you flashed back the unlocked partition. If everything works well, then I can extract the info I need from the param dumps to make the app work on toroplus. In the unlikely case that the last flash doesn't unlock your bootloader then we will be out of luck in supporting toroplus.
[Samsung Galaxy Nexus] segv11:
I have received toroplus (Sprint) param images in a private message. They appear to be almost the same as the toro (Verizon) images.

0) Like all the other Galaxy Nexus, the bootloader lockstate is at 0x000007c. Woot!

1) Toroplus has 0x73 ("s") at offset 0x0000014. All other variants, including toro, have 0 there.

2) Like toro (and unlike maguro), toroplus has the baseband version at offset 0x0000084.

3) Like toro (and unlike maguro), toroplus has the WiFi MAC address at offset 0x0000c90.

4) Like toto, toroplus as nothing at offset 0x0001094. Maguro has the carrier-code here, same as is found in /factory/imei/mps_code.dat.

I will be preparing a version of the app with toroplus (Sprint Galaxy Nexus) support soon, as well as a bugfix for those of you using ChainsDD's Superuser. Please be patient, as I am too busy lately to turn around a new version immediately.

If you wish to test the app before I release it, please let me know... especially if you have a toroplus. If you contact me privately, please let me know whether you want your contribution to be acknowledged publicly or if you would your contribution to be anonymous.
[Samsung Galaxy Nexus] segv11:
Has anyone with the Jelly Bean bootloader (PRIMELC03) and tried this app? It seems to have stopped working on that version. Will investigate on my toro, but would like to check with any toroplus or maguro users who have flashed the new bootloader.
[Samsung Galaxy Nexus] efrant:
Works just fine on LC03.
[Samsung Galaxy Nexus] segv11:
I'm having issues in PRIMELC03 where it _seems_ to work, but doesn't take effect. Example:

* start with an unlocked bootloader

* "lock" it in the app; confirm that the apps shows "locked"

* adb reboot bootloader

* Bootloader Screen shows "unlocked" (what?!?)

* boot into Android

* run app, app still shows "locked"

I wonder if LC03 is using a different method. Please let me know what you are experiencing. I received param dumps which make me pretty confident that toroplus will work the same as toro and maguro. But I have some doubts about PRIMELCxx series bootloaders; a toroplus beta tester with PRIMELC02 is reporting the same issue I just described.