yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] segv11:
On the Nexus 5, the tamper flag was set by performed by the first "fastboot oem unlock". If the app works, we should be able to clear it...
[Samsung Galaxy Nexus] Polarfuchs:
Ok, it recognizes the correct current state now on Oneplus One Rom XNPH44S
[Samsung Galaxy Nexus] segv11:
Good. Can you verify that the lock/unlock and tamper/untamper buttons work as expected? It would mean locking, reboot to bootloader to make sure it's locked; unlock, reboot to bootloader; untamper and reboot to bootloader; tamper and reboot to bootloader...
[Samsung Galaxy Nexus] Polarfuchs:
...locking, reboot to bootloader to make sure it's locked...:good:

...unlock, reboot to bootloader...unlocked, tampered :good:

...untamper and reboot to bootloader...still unlocked, but untampered also :good:

...tamper and reboot to bootloader...still unlocked and now tampered again :good:

It all works. Thank you :D
[Samsung Galaxy Nexus] segv11:
Great, thank you. I'll probably make a Play Store release later tonight, unless we also get shamu working this evening.

Sent from my Manta
[Samsung Galaxy Nexus] efrant:
Unfortunately I won't have time to try and figure out shamu tonight. As soon as I do, you guys will be the first to know! ?
[Samsung Galaxy Nexus] segv11:
OnePlus One support is published

A new version with bacon / A0001 (OnePlus One) support has been published to the Play Store.

You can also download the APK from Google Drive: https://drive.google.com/file/d/0B6qHcVHPO4VrUmpZUWd6Mnh5elE/view

This version also includes fixes for crashes on unsupported devices.

Thank you all for your research and beta testing. Thank you especially to Polarfuchs, who provided the offsets for this device.
[Samsung Galaxy Nexus] DylonSaaied:
Unlocking bootloader on nexus 4, rooted with towelroot.

Hi segv11,

I wanted to ask you if I can unlock my boot loader, while towelrooted? Because I need to flash my system partition and I don't have my boot loader unlocked yet.

Thanks in advance :D
[Samsung Galaxy Nexus] efrant:
If you are using a supported device, then yes.
[Samsung Galaxy Nexus] chef_christoph:
Hello everyone, I've been following along with the discussion since [MENTION=1566190]efrant[/MENTION] brought this to my attention but haven't been able to jump in until now.

I'm fascinated by and appreciative of all the work you all have put in to get this working and wondered if you might need another tester. I'm no developer or programmer but I love to tinker with things and would be willing to help if it would be useful.
[Samsung Galaxy Nexus] segv11:
We can always use testers for new versions/newly-supported devices.

An even bigger help would be someone to pull partition images in order to support new devices (like the Nexus 9), or to flash random changes to help identify candidate locations (like [MENTION=1566190]efrant[/MENTION] is doing with Nexus 6).

What device(s) do you have?

Sent from my Manta
[Samsung Galaxy Nexus] chef_christoph:
I'd be happy to help with whatever's needed. I'm currently using a Nexus 6 and also have the Nexus 5 & 4.
[Samsung Galaxy Nexus] segv11:
Cool! You and [MENTION=1566190]efrant[/MENTION] both have the Nexus 6. We have 7 candidate locations for lockstate identified by [MENTION=4544860]osm0sis[/MENTION]; we need to identify which one (or which combination) is needed to lock/unlock the device. Perhaps the two of you could coordinate.

Sent from my Manta
[Samsung Galaxy Nexus] efrant:
I had some free time this morning so I took another stab at it. I've tried these locations/values:

24 01/00
57 02/00
65 04/00
67 09/00
1066 04/00
1033 2c/00
1038 11/00

I tried flipping them from 00 one at a time (rebooting to verify lock status after each attempt), and then I tried them all together, and the bootloader remains unlocked in each case.

And I tried it both using [MENTION=4551856]segv11[/MENTION]'s syntax (e.g., echo -n '\x04' | dd obs=1 count=1 seek=1066 of=/dev/block/platform/msm_sdcc.1/by-name/sp) and [MENTION=4544860]osm0sis[/MENTION]' syntax (e.g., echo -ne "\x04" | dd obs=1 count=1 seek=1066 of=/dev/block/platform/msm_sdcc.1/by-name/sp), with the same result in each case. Maybe [MENTION=5039076]chef_christoph[/MENTION] could verify if he feels up to it.
[Samsung Galaxy Nexus] Cheater912:
Could we find the locations by reverse engineering the bootloader?
[Samsung Galaxy Nexus] segv11:
That's what we attempting to do. However, we already know that the contents of the sp dump are sufficient, because [MENTION=1566190]efrant[/MENTION] was able to lock/unlock by flashing the dumps on his device.

We are now trying to isolate which of the differences between locked and unlocked dumps actually do the trick.

I am wondering if the bootloader is doing something between reboots that is messing us up. Perhaps we could test:

- flash unlocked image

- change the candidate byte(s)

- reboot and check

- repeat...

- Also, we might want to check more locations. I need to look at the dumps myself.

Sent from my Manta
[Samsung Galaxy Nexus] segv11:
I've been thinking about the echo syntax: according to the manuals, [MENTION=4544860]osm0sis[/MENTION] actually has the correct syntax. Whether it makes a difference depends on the version of the shell and of toolbox/busybox installed on your system. It would not be hard to test:

echo -n ' \x01' | od -c

and

echo -ne "\x01" | od -c

should show us how your device processes hex escapes.

Potentially neither of these may work right without busybox.

The app actually doesn't use either. It writes the raw byte from java directly to stdin of dd.

Sent from my Manta
[Samsung Galaxy Nexus] efrant:
Good idea. I'll try that when I have time.

One other thing that I'm not sure has an impact is the "Enable OEM unlock" option in Developer options. Maybe one of you gurus can have a look at the AOSP code for that?

(Just an FYI, when I first got my N6 and opened the box, I booted into the bootloader right away and unlocked it. When I then booted into Android and enabled developer options, I noticed that the "Enable OEM unlock" option was not enabled, even though my bootloader was unlocked - - and this is despite that I had read that the option had to be enabled to unlock.)

On a separate note, I wonder if there is such a thing as an "engineering bootloader" for Motorola devices? (HTC devices had them, and I managed to get one flashed on my Nexus One back in the day.)

There are dumps linked in posts 446 and 449.
[Samsung Galaxy Nexus] segv11:
Also, try replacing "echo" with "busybox echo" to force the use of busybox echo instead of the shell's built-in.

Once we find the syntax that correctly yields one byte on your device, we can have more confidence that the dd command is doing what we expect...

Sent from my Manta
[Samsung Galaxy Nexus] osm0sis:
All the common differences again. If it's not a single point then that sst_token and NKOT (token backwards?) stuff might become significant. Hopefully the unique data isn't a security hash that gets generated.

Simplest way to determine the echo/dd is working would be to dump and hexedit to make sure only the specified byte was changed.

Edit: I think the next step would be to make all of these common changes at once to see if the unique data is required or superfluous. I'll make a flashable script to do this.
[Samsung Galaxy Nexus] segv11:
A little information about Motorola Bootloaders http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html

This may be only partially relevant, since it talks about the Moto X, but it implies that

a) initial unlock and relock may not "look" the same (that may not stop the app, but it might be tamper protection; also it may affect towelrooters who want to use the app for their initial unlock)

b) at least in the Moto X, there are crypto tokens involved
[Samsung Galaxy Nexus] chef_christoph:
Sorry for the delay, I had a significant flood in my home yesterday and it fried my computer. I'm up and running enough to have run through all of these same locations/values with both syntax variations. I can unfortunately verify no success.
[Samsung Galaxy Nexus] segv11:
A flood - that sucks. I had that happen a year and a half ago, and it was a real pain.

Let's see whether the [MENTION=4544860]osm0sis[/MENTION] idea of flashing all the common changes works.

Sent from my Manta
[Samsung Galaxy Nexus] osm0sis:
Here's hoping! If this works then we can start narrowing it down again by removing offsets one at a time. If it doesn't, well then it must be the Moto crypto "sst" token(s) screwing us up and we may be out of luck for the N6.. :(

But before we get all sad (;)).. finger's crossed.. :fingers-crossed:

[MENTION=1566190]efrant[/MENTION] [MENTION=5039076]chef_christoph[/MENTION]

[ Attachment removed ]
[Samsung Galaxy Nexus] efrant:
Starting with an unlocked bootloader, I flashed your zip, and the bootloader remained unlocked.
[Samsung Galaxy Nexus] chef_christoph:
I had the same result when starting from unlocked.

However, I did get what looks like a promising result when running the script immediately after flashing the locked image.

The script identified the BL state as locked and proceeded to unlock it. When I reboot into the system as well as the BL it remains unlocked.
[Samsung Galaxy Nexus] segv11:
Weird. So we can unlock, but not lock?

It is interesting to note that the non-common change at 0x042c-0x043b is exactly 16 bytes long; a convenient length for a hash.

Sent from my Manta
[Samsung Galaxy Nexus] Cheater912:
Or a UUID. I'd be surprised if anybody is still using MD5 or similar.
[Samsung Galaxy Nexus] osm0sis:
Not that weird, to unlock all we have to do is zero a few sections, but to lock, unfortunately, it appears we would need to reverse engineer the security tokens.

So the only way we could handle it officially would be my idea for having BootUnlocker allow a power user (after a serious disclaimer and an Advance Option toggle perhaps) to capture the dumps in the two states and then tie flashing them whole to the app buttons. Basically what I suggested for the N7 2012.
[Samsung Galaxy Nexus] osm0sis:
Hmm thinking some more, does flashing it again allow you to relock? It should leave the tokens intact, so might be possible. That would mean as long as a rooted user started with a locked bootloader BootUnlocker could do its thing. BootUnlocker could check for the existence of the tokens and if they don't exist request the user oem lock before using it.
[Samsung Galaxy Nexus] segv11:
This might work, but it is definitely getting complicated.

Now we need to know: which of the locations in a locked bootloader need to be cleared in order to unlock, and which of those need to be saved for relocking.

And I need to read up on how to save user data, and disallow backups (we wouldn't want people restoring a BootUnlocker backup from one N6 onto a different one).

I hope the N9 is easier, if we can get some dumps.

Sent from my Manta
[Samsung Galaxy Nexus] segv11:
What happens if a user writes a bad lock token to an unlocked device? Does it brick, or does it simply fail to lock?

Also, I wonder what the situation looks like before the first unlock. Does the first unlock just clear some tokens from sp like second unlocks do, or does it blow a qFuse like it does on the Moto X (according to the page I linked to earlier)?

Sent from my Manta
[Samsung Galaxy Nexus] chef_christoph:
Yes, flashing the script a second time immediately after the first relocks the bootloader
[Samsung Galaxy Nexus] osm0sis:
I'm just saying we could leave the tokens alone. As long as there's root and the tokens exist we can write the common changes around them and control the lock state as long as the initial state was locked. ;)
[Samsung Galaxy Nexus] sordna:
Why not keep things simple and only offer the unlock option in BootUnlocker for the N6.

Users can always lock using fastboot. The main benefit of BootUnlocker which is to unlock preserving your data, will still be there.
[Samsung Galaxy Nexus] Cheater912:
Can that be a security risk? Everybody would be using the same keys if that's what's in there.
[Samsung Galaxy Nexus] osm0sis:
You misunderstand. The tokens are the unique data. I'm proposing we don't touch them at all, so each device remains with its own "key".
[Samsung Galaxy Nexus] segv11:
Wait, so does flashing ONLY the common changes to a locked device unlock it? So I don't need to wipe and restore the token, just leave it alone?

In that case, my next question would be do I have to flash ALL the common changes to unlock, or only some of them?

Sent from my Manta
[Samsung Galaxy Nexus] osm0sis:
Yup, that's what I suggested and was tried here: http://xdaforums.com/showpost.php?p=58153849&postcount=503

Whether only some suffice is the next big question.
[Samsung Galaxy Nexus] osm0sis:
Proof of concept. Won't flash on an unlocked N6 bootloader (to relock) by checking for the existence of the first token, and will advise in this case the user fastboot oem lock before flashing again.
[Samsung Galaxy Nexus] RushTea:
Can test this if you want. How safe is it? Ie, if it "breaks", will it brick, force flashing, or just me to factory reset?
[Samsung Galaxy Nexus] osm0sis:
I'm fairly confident in the script, but you're best practice would still be backing up one state or the other of your sp partition first. You would need to flash this partition dump back to sp if something went wrong, though honestly locking and unlocking again might fix it too. Factory Reset doesn't act on any partitions BootUnlocker will ever come in contact with.
[Samsung Galaxy Nexus] RushTea:
Bit nooby on the backing up specifics part. Could you provide the full path to the files I should back up?

Edit: did a backup of boot, firmware and efs. Is this sufficient?

Big fat edit: That's a brick. Flashed it once before relocking, locked, then wouldn't boot into anything but the bootloader. Totally should have done a full backup, good thing the device is only a day old!

Even more editing:

So, according to what I saw, this following bit did NOT happen, and the script claimed to have unlocked my bootloader:

ui_print "Security token not present.";
ui_print "Please fastboot oem lock before flashing.";
[Samsung Galaxy Nexus] chef_christoph:
Hello all,

I've been tinkering with my Nexus 6 today and flashing the unlock script supplied by [MENTION=4544860]osm0sis[/MENTION] upthread and something occurred to me.

It appears as though there are (at least) two different unlocked states of the bootloader in the Nexus 6.

One unlocked state allows relocking of the bootloader through the use of the script and the other doesn't seem to.

I was able to get dumps of the sp partition in both unlocked states and generated an MD5 of each .img and they are different.

At first glance it seems that booting into the bootloader, rebooting the system or a combination of both after unlocking the bootloader is what is changing the unlocked state. I haven't had time yet to try and figure out the cause.

My thought is that if we can figure out what the difference is between the two unlocked states, maybe there's a way to retain the ability to relock the bootloader using the script even after booting into the bootloader/rebooting the system.

Please let me know if this is old news and not worth looking into further or if additional examination could prove helpful.
[Samsung Galaxy Nexus] RushTea:
This seems consistent with why my phone died after the script believed my boot loader was locked. Currently unable to retest as I'm travelling, but can brick my phone many times over once I have some proper backups.
[Samsung Galaxy Nexus] chef_christoph:
I've had some more time to test.

As mentioned in my previous post, it looks to me like we've got two different and distinct unlock states. I've taken to referring to them as "OEM unlocked" and "script unlocked".

Starting from OEM locked the script will continue to toggle back and forth between script unlocked and locked repeatedly with no problems - until any form of reboot into bootloader or system.

After any reboot into the bootloader or system the unlock state changes from script unlocked to OEM unlocked.

From OEM unlocked, the script will not switch back to locked. This appears to mean that after every reboot, if the bootloader is unlocked, the script wouldn't be able to lock the bootloader again without an OEM lock being done.

I noticed some discussion earlier in the thread about having users manually go back to OEM locked after installing BootUnlocker.

I wonder now if we might have an additional avenue to try? Instead of having users manually go back to OEM locked, what about trying to have the script attempt to reflash the data to unlock again before attempting to lock?

What I have in mind is having the script change the bootloader unlock state from OEM unlocked to script unlocked and therefore be able to use the script to relock and avoid the need for the user manually doing an OEM lock.

I haven't had time to really look at the script that [MENTION=4544860]osm0sis[/MENTION] posted upthread but I could try to modify it to test this concept. I may need assistance with this if I get stuck but I'm not afraid to at least try it before asking for help from you all.

I am by no means proficient with this so if anyone thinks I'm on the wrong track, or you've already been down this avenue with other devices without success, let me know.
[Samsung Galaxy Nexus] chef_christoph:
I've flashed this a few times with OEM unlock but don't get any notification to do OEM lock before flashing again.
[Samsung Galaxy Nexus] Prfndhatrdofman:
Was told to post here by support...looking for support for shield tablet. Device is close to nexus status, supports fastboot oem lock/unlock
[Samsung Galaxy Nexus] segv11:
If you are willing and able to tamper with your device, the instructions on how to extract the images we need to begin are in post five.
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4551856]segv11[/MENTION]

Thanks for making this handy app. Can you please add support for YU Yureka / tomato??

Like OnePlus One, on YU Yureka, the bootloader uses position 0x000FFE10 of the "aboot" (mmcblk0p4) partition, stored as 00 / 01. It also has a "Tamper" flag, at position 0x000FFE14 of the "aboot" partition. For this device, you can see the status of the flags using "fastboot -i 0x1ebf oem device-info". FYI, there is another partition named "abootbak" (mmcblk0p5) which is holding the backup of the original contents of "aboot", but there is no visible effects of it.

Unlock bit:

Tamper bit:
[Samsung Galaxy Nexus] segv11:
Yeah, I can try to roll it in next weekend, if you're able to beta test.

Sent from my Manta
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4551856]segv11[/MENTION]

Thanks for replying. I'm always ready for beta testing.

:)
[Samsung Galaxy Nexus] djcsurf:
Has work on the Nexus 6 hit a brick wall, would be a shame but the effort to try is appreciated.
[Samsung Galaxy Nexus] osm0sis:
Unfortunately seems that way from my point of view because of the multiple states [MENTION=5039076]chef_christoph[/MENTION] discovered. :(
[Samsung Galaxy Nexus] efrant:
Yeah, I tend to agree. The only other thing I can think of is if anyone is an IDA Pro wizard, he could maybe have a look at the bootloader and see what he could come up with.

Just to confirm, the source isn't provided anywhere, correct? [MENTION=3682533]AdamOutler[/MENTION] seems to suggest in this post (way back when we were looking at the GNex) that the source for the GNex bootloader was available.
[Samsung Galaxy Nexus] paulr24:
What happens if you forget to unlock the bootloader before flashing a ROM update? I knew I'd forget eventually haha. I assumed it just wouldn't let me flash but apparently that's not the case. Now I'm getting nonstop "unfortunately, system UI has stopped" notifications and the nav bar is gone on my OPO. I was able to get back into BootUnlocker, unlocked the bootloader, and tried reflashing but that didn't change anything. It could be an issue with the cm12 official nightly I guess but I'm thinking that's probably not the case since I've tried flashing both the 2/3 and 2/4 updates.
[Samsung Galaxy Nexus] osm0sis:
Completely unrelated.
[Samsung Galaxy Nexus] SkandaH:
Sorry to bug you; any news?

:cyclops:
[Samsung Galaxy Nexus] segv11:
I got swamped work. I'll catch up when I can.

Sent from my Manta
[Samsung Galaxy Nexus] nyuszika7h:
Now which one is which? I'm assuming the former should say "unlocked".
[Samsung Galaxy Nexus] joeyhuab:
Could Android One devices be supported in the future? I'm requesting because it's also Google software and AOSP.
[Samsung Galaxy Nexus] SkandaH:
I have tested Micromax Canvas A1 in a hurry; it doesn't support the following command:

fastboot oem device-info

I still need to compare the partitions before & after bootloader unlocking to find any difference. Interesting thing is they are based MediaTek 6582 SoC - a full flash using SP Flash Tool does re-lock the bootloader.
[Samsung Galaxy Nexus] KopiJahe:
For android one, refer to my thread for manual way.

Android one uses this command to display warranty/tamper flag:

fastboot getvar warranty

The key relies in seccfg partition. Update: if the seccfg partition is nulled, the bootloader and warranty flag is back.

Maybe it will be supported in the future?
[Samsung Galaxy Nexus] smiffy 626:
Nexus 6 (Shamu)

When is this going to be available for the nexus 6. I'd really like to have the freedom to relock my boot loader via the app. If it needs a contribution I'll be more then happy :)
[Samsung Galaxy Nexus] playahate:
[MENTION=4551856]segv11[/MENTION] some information about Nexus 9 from Jonathan Levin:

View attachment 3309221

And another information from the android.googlesource.com

Maby this will also help with Nexus 6...
[Samsung Galaxy Nexus] playahate:
And some Nexus 7 related information/question for [MENTION=4551856]segv11[/MENTION]

According to [MENTION=3110798]WugFresh[/MENTION] Google Changes New and Old Factory Packs for Nakasi and Nakasig

Maby this will change the situation with N7 2012?
[Samsung Galaxy Nexus] osm0sis:
Unfortunately, the new bootloader most likely wouldn't change the overall Tegra security in use on the N7 '12.

As for the N6 and N9, this "oem bit" is kind of interesting. I wonder if flipping it and then rebooting to bootloader, then back to recovery might resolve the 3rd state issue [MENTION=5039076]chef_christoph[/MENTION] described?
[Samsung Galaxy Nexus] markusf21:
I hope the nexus 6 will be figured out. My computer is broken so I haven't been able to unlock my bootloader. Fortunately I did figure out how to root and get twrp without a computer.

Sent from my Nexus 6
[Samsung Galaxy Nexus] openbook:
I erased everything on my phone and then tried using the flash-all.bat from image-shamu-lmy48i.zip.

It failed saying could not allocate so many bytes.

Accidentally i did lock my bootloader using fastboot oem lock.

Now cant load anything and my phone doesn't boot.

When i try fastboot oem unlock it says enable that option under developer options.

I am now with a brick Nexus 6 please help me out of this situation.
[Samsung Galaxy Nexus] efrant:
Unfortunately there is nothing you can do. Once you relock the bootloader on an N6 (without following the proper steps as per this thread: http://xdaforums.com/nexus-6/general/guide-safely-lock-bootloader-android-5-1-t3067302) you are out of luck. You need to send it in for repair.
[Samsung Galaxy Nexus] Trina9:
Any news to see if this will work on a Nexus 6?
[Samsung Galaxy Nexus] SkandaH:
[MENTION=4551856]segv11[/MENTION]

Any chance of updates? BTW, you should update the project home from Google Code to GitHub.

BTW, we can also support YU Yuphoria now, and probably 2nd Gen Android One devices.
[Samsung Galaxy Nexus] fmc000:
This app does not work on my OnePlus One running Hydrogen OS. Please see the attached screenshot.
[Samsung Galaxy Nexus] DeeZigneZ:
Any chance to get the unlock only version for nexus 6 please.. Right now without an cpu so I'm unable to unlock..maybe some one can also push me to a link to root and twrp whittout pc too.. Sorry totally new to the nexus world..would be great if someone could help..
[Samsung Galaxy Nexus] souvikdas95:
Sir, please make it compatible with OnePlus Two