yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] efrant:
I did just that: started off unlocked, went into your app which showed unlocked, then locked using your app, rebooted, and the bootloader was locked. Then I went back into you app which showed locked, and I unlocked again.
[Samsung Galaxy Nexus] segv11:
Never mind - my error. This was due to a bug in the toroplus beta that I was working on. It should not affect anyone except me and two beta testers.
[Samsung Galaxy Nexus] segv11:
That bug is fixed; I have another beta which should support toroplus. It also addresses a problem with duplicate Superuser requests for users of ChainsDD's Superuser.

PM me if you want to beta-test... even if you don't have a toroplus. I'd rather catch bugs with a few beta testers than a large installed userbase. I'll try my best not to trash your device. :fingers-crossed:
[Samsung Galaxy Nexus] segv11:
NEW VERSION 1.1

is available: now supports toroplus. First posts updated.

Changelog

:

Adds support for "toroplus" (Sprint Galaxy Nexus)

Corrects multiple-su-request issue for users of ChainsDD's Superuser app

Downloads

Download application from Google Play: http://play.google.com/store/apps/details?id=net.segv11.bootunlocker

Download application from Google Code: http://code.google.com/p/boot-unlocker-gnex/downloads

As always, please report any issues you have so I can fix them promptly.

If you have another Nexus device you'd like to be supported, and you don't mind a little hacking, let's talk... :)
[Samsung Galaxy Nexus] segv11:
I'm seeing requests for Nexus 7 support, but I do not have such a device to experiment with. Before opening a request thread in the Nexus 7 forums, I though I would check if anyone here has a Nexus 7 that they want to hack on.

Also, if you have an older nexus device (like a Nexus S or Xoom) we can see what we can do with those...
[Samsung Galaxy Nexus] segv11:
No luck on Nexus 7. Someone volunteered to work through the necessary images with me on the device. Being a WiFi-only ASUS tablet, the partitions and bootchain are very different from the Samsung G-Nex. Doing "fastboot oem lock" only changed one partition: mmcblk0boot0, and it changes it in many places.

This is a special partition, not normally writeable even as root, storing low-level bootloader stuff. (G-Nex doesn't even use it: the bootchain starts in the _radio_, then into sbl and xloader.) I'm not going to risk bricking peoples devices by scribbling boot0. Unless someone who knows ASUS bootloaders steps forwards, I'm going to drop the idea of supporting non-Samsung Nexus devices. :(

Sent from my Jelly Beaned "toro" Galaxy Nexus.
[Samsung Galaxy Nexus] chandradithya:
Thanks a ton, for making this app. :victory:

It was the only thing i needed :)
[Samsung Galaxy Nexus] dechronic:
Thanks I just found the tool to change the imgdata partition to do that.

Oh yeah I just searched and saw the tool that modifies the image data to do that.

I found that hex value to turn oem unlocking toggle on or off...

I am new to the nexus 5x so I was just fooling around with it and realized the toggle only applies to unlocking the phone and not locking it.

It is located at the 0007FFFF (the end of the file) of the persistent.img partition it is the last value. it needs to be changed from 00 to 01 to enable oem unlocking.

The changes for locking and unlocking take place in the misc.img partition. Looking at it from a hex editor it appears there may be a toggle to prevent a wipe of userdata when locking/unlocking.. I will see what I can find.
[Samsung Galaxy Nexus] SkandaH:
http://xdaforums.com/nexus-5x/help/req-help-to-unbrick-t3251740

BTW, thanks for your contributions.

:highfive:
[Samsung Galaxy Nexus] dechronic:
Thanks. I read that already and I have all the necessary files downloaded and on standby just in case. :D

Going to try something else today.
[Samsung Galaxy Nexus] osm0sis:
Great work so far! :)

Next step would be to flash your misc unlocked dump whole while the device is locked. To do so you'd just dd if=/sdcard/dumps/misc-unlocked.img of=/dev/block/platform/*/*/by-name/misc;

Then, if that works, multiple dumps of locked and unlocked to hopefully rule out some spots. Ideally we also need another volunteer device to really rule some stuff out.
[Samsung Galaxy Nexus] dechronic:
I just noticed something as well when I was locking and unlocking the bootloader. I recorded it with a camera to make sure I got it.

Everytime the bootloader is locked or unlocked a green message at the bottom appears saying "erasing..." for about a half second if that long.

Could be erasing the security key or certificate?

According to google at http://source.android.com/security/verifiedboot/verified-boot.html#bootloader_requirements

Where could the write protected bit talked about there be? The system partition?

I understand that with the stock recovery and after locking or unlocking the phone automatically erases the data and maybe cache as well. Is that right?

With TWRP installed it doesn't boot unless you manually wipe the data partition.

---------- Post added at 03:07 PM ---------- Previous post was at 02:37 PM ----------

I know it was a long shot but I did a comparison of the system partition when locked and unlocked. 3GB a piece...but no joy.
[Samsung Galaxy Nexus] osm0sis:
Well that's definitely bad news for the process if flashing misc whole doesn't work..

Wonder if it's related to my initial findings?

The repeating hash might mean it's not only a static 01/00 flip, but a unique security token written with it that makes it valid.. maybe along the lines of what christoph and I were working out for the N6 which I quoted a page back. :(
[Samsung Galaxy Nexus] osm0sis:
Also, here's how a N5X OTA updates the bootloader:

ui_print("Writing bootloader...");
[B]package_extract_file("bootloader-flag.txt", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/misc");[/B]
package_extract_file("bootloader.sbl1.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/sbl1bak");
package_extract_file("bootloader.tz.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/tzbak");
package_extract_file("bootloader.rpm.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/rpmbak");
package_extract_file("bootloader.aboot.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/abootbak");
package_extract_file("bootloader.pmic.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/pmicbak");
package_extract_file("bootloader.hyp.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/hypbak");
package_extract_file("bootloader.keymaster.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/keymasterbak");
package_extract_file("bootloader.cmnlib.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/cmnlibbak");
lge_bullhead_update_gpt();
package_extract_file("bootloader.sbl1.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/sbl1");
package_extract_file("bootloader.tz.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/tz");
package_extract_file("bootloader.rpm.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/rpm");
package_extract_file("bootloader.aboot.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/aboot");
package_extract_file("bootloader.pmic.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/pmic");
package_extract_file("bootloader.hyp.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/hyp");
package_extract_file("bootloader.keymaster.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/keymaster");
package_extract_file("bootloader.cmnlib.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/cmnlib");
lge_bullhead_recover_gpt();
package_extract_file("bootloader.sdi.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/sdi");
package_extract_file("bootloader.imgdata.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/imgdata");
package_extract_file("bootloader.sec.img", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/sec");
[B]package_extract_file("bootloader-flag-clear.txt", "/dev/block/platform/soc.0/f9824900.sdhci/by-name/misc");[/B]

Perhaps some hint in there since it overwrites misc with txt files.. then there are those mystery commands in the middle to do with the gpt.
[Samsung Galaxy Nexus] dechronic:
I found some of those too and I tried flipping them one by one and flashing to see if it makes a difference.

Those same partitions showed changes for me too if I booted the phone, so I would unlock, boot to recovery grab the dumps, reboot to bootloader, lock, boot to recovery and grab dumps and the only partition that changed was the misc.

If I booted the OS between locked and unlocked states, the changes were for the same partitions you mentioned totaling about 53MB of data. Most of the data was from the modemst1 and modemst1 partitions and that was with no wifi connection or sim card.

I believe what you are saying is true that the states are linked to a generated key/certificate, as each time the lock state is changed a small message at the bottom of the screen saying "erasing..." appears at the bottom of the bootloader screen for about a half second or less, even before it boots into the recovery. I believe that is why the encrypted /data partition is no longer accessible as locking/unlocking erases the key/certificate needed to access the encrypted data, hence the need for the bootloader to force wipe the /data partition to force re-encryption of the partition on the next boot using the newly generated key/certificate.

---------- Post added at 07:01 PM ---------- Previous post was at 06:56 PM ----------

I actually found a tool that extracts those same files (except the bootloader-flag.txt or bootloader-flag-clear.txt) from the bootloader.img included in the stock image files.

I will get those bootloader-flag.txt, bootloader-flag-ckear.txt files and take a look at them to see what they are changing in the /misc partition. I will try and find the link to it now.

EDIT: Found them...downloading now

---------- Post added at 07:07 PM ---------- Previous post was at 07:01 PM ----------

I checked them. It seems it is for a check to prevent changes to the /misc partition? the first file only has "updating-bootloader" with some extra 00 of hex and the other is all zeroed out.. I wonder if I flash the unlocked misc partition with that flag at the start of it what would happen...

---------- Post added at 07:23 PM ---------- Previous post was at 07:07 PM ----------

I tried using an unlocked misc image on a locked bootloader and replaced those first 19 bytes before flashing but it doesn't make a difference...
[Samsung Galaxy Nexus] osm0sis:
What about flashing both text files like the zip does?

dd if=/sdcard/dumps/bootloader-flag.txt of=/dev/block/platform/soc.0/f9824900.sdhci/by-name/misc;
dd if=/sdcard/dumps/misc-unlocked.img of=/dev/block/platform/soc.0/f9824900.sdhci/by-name/misc;
dd if=/sdcard/dumps/bootloader-flag-clear.txt of=/dev/block/platform/soc.0/f9824900.sdhci/by-name/misc;
[Samsung Galaxy Nexus] Lrs121:
How would a modified boot image with force encrypt removed potentially effect anything along with the need to wipe the data partition if it was never actually encrypted?
[Samsung Galaxy Nexus] osm0sis:
From the build.prop:

ro.frp.pst=/dev/block/platform/soc.0/f9824900.sdhci/by-name/persistent

Would you be able to post a copy of the persistent partition with the bit changed? I can at least add it to the oem unlock toggling support I have going in my flashable zip, though that's only really useful in weird circumstances with a custom recovery.
[Samsung Galaxy Nexus] osm0sis:
Yes, that's odd, the sequential dumps you just sent only go from "10 12" to "18 12" and back again. Not sure what makes it jump now, but we certainly know it can since your older ones were "11" not "12".

Differences aren't as important as similarities between same-state dumps. That's why I used the Linux util (and flags) "comm -1 -2" to find the common lines between both locked dumps you previously sent me, and then did the same between the unlocked dumps. Those can be diff'd to find the consistent changes as I included in my previous post, and it's a more useful/readable output.

Here are the commands if you're not familiar and/or are interested:

xxd 1-misc-locked.img 1-misc-locked.xxd;
xxd 1-misc-unlocked.img 1-misc-unlocked.xxd;
xxd 2-misc-locked.img 2-misc-locked.xxd;
xxd 2-misc-unlocked.img 2-misc-unlocked.xxd;

comm -1 -2 1-misc-locked.xxd 2-misc-locked.xxd > comm-locked.xxd;
comm -1 -2 1-misc-unlocked.xxd 2-misc-unlocked.xxd > comm-unlocked.xxd;

diff comm-locked.xxd comm-unlocked.xxd > diff.txt;

Edit: And that's good about persistent's oembit being at 7FFFF (524287), since that's at least constant across all the FRP-enabled devices so far.

So for all devices N6 forward one potentially needs only:

block=`getprop ro.frp.pst`;
offset=524287;
unlocked=01; locked=00;
echo -ne "\x$unlocked" | dd obs=1 count=1 seek=$offset of=$block;

Does "getprop ro.frp.pst" work from within recovery? Again, pretty limited use-case, but it would be kind of nice to have all current (and potentially future) FRP-enabled devices covered with a few simple commands.
[Samsung Galaxy Nexus] dechronic:
getprop ro.frp.pst gives

/dev/block/platform/soc.0/f9824900.sdhci/by-name/persistent

Only started really get into Linux because of the Nexus 5 I got about Feb/Mar 2014.... So I have a lot to learn but I am willing...reading up on the xxd command..

I have a VM of Ubuntu 14..04 LTS for builds, mounting images, learning more linux commands and the such..
[Samsung Galaxy Nexus] osm0sis:
Perfect, thanks! What about:

wc -c < $(getprop ro.frp.pst);

from in recovery? :)
[Samsung Galaxy Nexus] dechronic:
I get

524288
[Samsung Galaxy Nexus] osm0sis:
Cool! As you mentioned, Google's spec says last byte is the offset for the oembit, so we can just do the following to calculate it, on the off chance that a new device down the road changes the length of the frp.pst partition from 512kb:

block=`getprop ro.frp.pst`;
offset=$((`wc -c < $block` - 1));

This gives me the chance to simplify a bunch of my Nexus BootUnlocker script zip work and not have to add new devices just for FRP toggling from recovery. :D
[Samsung Galaxy Nexus] skulldreamz:
If you guys need someone with a nexus 6p (angler) I'm here. I have a little crack in the screen so I'm going to use this phone for learning purposes as i usually do with my phones once i get a newer one, so just wanted to let you know I'll be a guinea pig if you guys need one. You can contact me on hangouts at mylyfemylyfe32@gmail.com
[Samsung Galaxy Nexus] osm0sis:
[MENTION=4542027]skulldreamz[/MENTION], yeah wouldn't hurt to check out! Can you run the script I posted a couple pages back via adb shell in custom recovery to generate dumps for locked/unlocked then md5sum them to see which change?
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4544860]osm0sis[/MENTION]

Please take a look at this one if you get some time. I've also tagged you there.
[Samsung Galaxy Nexus] SkandaH:
Regarding newer Nexus devices, I think this thread gives us some interesting info.
[Samsung Galaxy Nexus] osm0sis:
Alrighty, we are a go. ;)

https://github.com/segv11/boot-unlocker/pull/39

[MENTION=4551856]segv11[/MENTION] [MENTION=5549875]thedropdead[/MENTION] [MENTION=5301049]Titokhan[/MENTION]

Also, my commit for the OnePlus 2 is pretty much a perfect template of all the changes required for anyone wanting to add any more devices going forward. :good:
[Samsung Galaxy Nexus] thedropdead:
Thank you for mentioning me, it is great to hear that somebody can use it. ;)

Great Work BTW
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4544860]osm0sis[/MENTION]

That's really great! Looks like its time to fire up Git :P

BTW, can you please add support for YU Yureka/Yureka Plus (ro.build.product=YUREKA) & YU Yuphoria (ro.build.product=YUPHORIA) as well?
[Samsung Galaxy Nexus] osm0sis:
I didn't want to go outside [MENTION=4551856]segv11[/MENTION]'s mandate of Nexus + OnePlus devices for this one, so let's wait a few days and see if it hopefully gets his attention, and then he can make the call about other devices. Then if he agrees you can use my OnePlus 2 commit as a template and make commits to add YU Yureka/Yureka Plus, Yuphoria and Zuk Z1 and pull request them in for him. :good:
[Samsung Galaxy Nexus] SkandaH:
Well, I'm trying to expand the domain by adding Cyanogen OS powered devices due to the freedom offered by them, just like Nexus devices - OnePlus One falls between two. :cyclops:

Anyway, I get your point. We should wait for [MENTION=4551856]segv11[/MENTION]'s input.

:cowboy:
[Samsung Galaxy Nexus] segv11:
I apologize that I've been too busy to maintain this software properly over the last couple of years. Thank you for making a pull request, that's probably the easiest way for me to incorporate stuff, given my limited brain bandwidth.

Unfortunately, I won't have access to my development platform until August. :( , and the toolchain for Android development is too big to install on a smaller machine. Merging pull requests should be a fairly easy thing for me to do one I get my computer back.
[Samsung Galaxy Nexus] segv11:
As far as I'm concerned, the only real criteria is that it works like an (old-school) Nexus. That is: if we can find a way to use root to scribble on some flags in a hidden partition to change the lockstate. There are some Nexus devices that could not be supported, especially the new ones, due to device-specific encryption of the bootloader or other security measures. If there are non-Nexus devices which are as easy as the G-Nex, in that we can confidently poke a couple of bytes to change the lockstate without breaking anything, then let's do it.

It will be August until I can merge any pull requests, however, because I am without a development machine at the moment.
[Samsung Galaxy Nexus] osm0sis:
Awesome! So any Cyanogen OS-powered devices are a go [MENTION=5301049]Titokhan[/MENTION], probably some of your ASUS devices too, and that HTC device [MENTION=1566190]efrant[/MENTION] mentioned a couple pages back could probably be handled as well, but we'd likely want/need [MENTION=4551856]segv11[/MENTION] to help make that happen since it's more than a 1-byte flip.

Just to reiterate, my OnePlus 2 commit is good as a template for anyone wanting to add a simple lockbyte + tamperbyte device, so fork my repo, then pull request away to the main [MENTION=4551856]segv11[/MENTION] one. :)
[Samsung Galaxy Nexus] dinomight:
So any change the OnePlus 3 will get support? How can i help get it to work.
[Samsung Galaxy Nexus] osm0sis:
Thanks for volunteering! :)

Follow the directions at the following link and in the OPs, and post. [MENTION=5301049]Titokhan[/MENTION] or myself will take a look at your partition dumps and see what we can find.

http://xdaforums.com/showpost.php?p=67147071&postcount=575

If we can figure it out I'll add it to my OnePlus Pull Request on the official repo and [MENTION=4551856]segv11[/MENTION] can release it in the next update when he gets his development workstation set up again.

Edit: [MENTION=470805]dinomight[/MENTION]?
[Samsung Galaxy Nexus] mkhcb:
I know you made this work on the OnePlus One. The Amazon Fire 5th gen has root on baseband 5.1.1... Is there a way you can add support for the Fire if I provide you with what you need? If so, just tell me what you need and how I can get it for you.

It be awesome to unlock the bootloader on the fire.
[Samsung Galaxy Nexus] _ult:
hey, [MENTION=1566190]efrant[/MENTION], how did you manage to dump sp partition in locked state?

i'm kinda stumped, because it requires root to access /dev/mmcblk, and :

1. having twrp during transition unlocked->locked causes bootloop (seems it's recoverable via fastboot format userdatat/cache), but then you're forced to reflash non-stock rom from zip anyway, so no access to sp with encrypted token via recovery.

2. supersu doesn't survive factory reset, that happens during lock. there's alternative (phhusson's su), that does, but it patches /boot partition anyway. and "safely relock N6" thread insists that you MUST be 100% stock before state transition. any info on what's happening if you do fastboot oem lock with modified boot partition?

the only idea comes to mind entails getting root via exploit in booted android, but afaik there's nothing public that works without modification on 5.1.1 and later. (kingroot may have some, but i dislike the idea of leaking my IMEI, even for statistic purposes)

and how did you dump it without booting to os at least once?
[Samsung Galaxy Nexus] efrant:
Back then, I was running Android 5.0 (which didn't have the issue of being 100% stock in order to re-lock the bootloader), and there was no such thing as "systemless" root.

What I did was unlock, dump the partitions, boot TWRP (not flash it, because you need the stock recovery in place), flash SuperSu (non-systemless version), re-lock the bootloader, boot into Android, and re-dump the partitions.

If you want to do it, you would need to flash back to Android 5.0 stock and proceed from there.
[Samsung Galaxy Nexus] _ult:
the bootloader of 6-MOB30W isn't downgradeable to 5-LRX21O. i wonder if this affects locking, i.e. is it backwards-compatible.

also, full-fledged device protection including FRP was implemented in 5.1.1+, and it's unclear how the process of relocking might internally differ from 5.0.

potential problem is that bootloader from MOB30W can call some command in TrustZone which was absent/implemented differently in 5.1.1.

any insight on that?
[Samsung Galaxy Nexus] efrant:
I don't really know. But you can try the following (although I haven't tested it, and I no longer have an N6):

Try downgrading your ROM to stock 5.0 but leaving the bootloader at its current version. Then boot into Android and check that there is no "Allow OEM unlock" option. If there is make sure you remove your lock screen password before doing anything else. Then you shouldn't have any issue (assuming you are using a new old SuperSU, i.e., pre- systemless).
[Samsung Galaxy Nexus] _ult:
did it, no issues so far. now i want to set a lockscreen password and bind an account to check whether it'll trigger FRP or not. why have you said not to do it? what should happen other than request to log in on all subsequent reboots/reflashes/resets?

what i'm trying to do is to dump frp+sp in locked bl + account bound + password set state, then unlock, flash latest 6.0.1, get root, dd twrp to recovery partition, then dd saved frp+sp to switch to locked state.

in the end i should have custom recovery, root and locked bl, which can be switched to unlocked with 2 dd's and no wipe. that with all FRP features

the only thing that i'm completely unsure about is does 5.0 implement all FRP features that 6.0.1 'll try to check.

so why shouldn't i set password/bind account? am i missing something?
[Samsung Galaxy Nexus] efrant:
There shouldn't be an issue with setting up a lockscreen password.

Just curious though. Why are you doing all of this? You do realize that having a locked bootloader with a custom recovery is kind of pointless?