yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] playahate:
[MENTION=4544860]osm0sis[/MENTION] hi.

Is it possible to make a script for N6/N9 that changes the setting "allow oem unlock"?

Theres many users that has bricked devices (or semi-bricked). If the system does not boot, theres no way to flash something with the locked bootloader. It gives the following line to almost every fastboot command:

Sometimes users:

1. Still able to get into TWRP if they "unlock bootloader - flash TWRP - flash SuperSu - lock bootloader".

2. Got blinking TWRP logo but adb still works.

The idea is:

In 1st case: run the script in TWRP that modifies the "allow oem unlock" bit of the partition, similar to your script with resetting the tamper flag.

In 2nd case: for Nexus 9 run smth like

adb shell dd if=/dev/block/mmcblk0p27 of=/sdcard/name_of_backup_from_another_device_with_oem_unlock_enabled.img

The .img must be taken after enabling the trigger in settings and reboot to recovery, because here is what i found:

android.googlesource.com

DevelopmentSettings.java

@Override
public void onCreate(Bundle icicle) {
super.onCreate(icicle);
if (!showEnableOemUnlockPreference()) {
removePreference(mEnableOemUnlock);

So, with the rest of code its shown that after enabling the option it is written to the partition, so the bootloader can get the info, but after the system boots, the trigger goes to OFF again.

Notes from a Nexus 9 by Jonathan Levin

So, is it possible to make a script, making smth like

...
echo -ne "\x01" | dd obs=1 count=1 seek=$allow_oem_unlock_bit of=$block;
...

so the users can flash it, if they still got working recovery, reboot to bootloader - aboot gets the proper info and users can make fastboot oem unlock again?
[Android Software/Hacking General [Developers Only]] osm0sis:
Absolutely, and great work bringing all that research together. :)

block=/dev/block/platform/sdhci-tegra.3/by-name/PST;
oembit=524284;
echo -ne "\x01" | dd obs=1 count=1 seek=$oembit of=$block;

Going by that dump snippet and counting (looks like 07fffc) then converting to decimal I got that offset, so you might want to double check it, but otherwise that's good to go.

Is aboot the lockstate partition like on the N6? What does it look like in both lock states? Is it like the N7 2012 with a repeating encrypted key preventing us from unlocking it manually, or like the N6 with a security token and a bunch of changing offsets with various states preventing us from unlocking it manually? ;)
[Android Software/Hacking General [Developers Only]] playahate:
Actually im not a developer, and even not involved in programming, my job is far away from the computers... and i dont even have N6 or N9 so can't check it out.

just made an article for the russian Hacker Magazine about changing databases (fake calls, sms, whatsapp messages etc), including /data/data/com.android.providers.settings/databases/settings.db and dig into code for information... then remembered the brick cases from the russian forum and tried to search some information...

So, eventually, we need some volunteers to check it out. The 2 guys from russian forum, i think completly bricked their phones. Trying to get to them...

And recently N7 2012 got new bootloaders , maby this will change something...

---------- Post added at 03:04 PM ---------- Previous post was at 02:29 PM ----------

one quick noob question...

can this script be signed anyhow with google keys?

in case users have stock recovery, rename the script to update.zip and use "apply update from adb" and "adb sideload update.zip".

or maybe be executed not with .zip but via adb...

---------- Post added at 03:26 PM ---------- Previous post was at 03:04 PM ----------

Some more info.

The Nexus 6 build.prop has:

The following line

Give us:

The full one is here, in case you need it

So you can make another one for Nexus 6...
[Android Software/Hacking General [Developers Only]] efrant:
Unfortunately not possible. Unless, of course, you could provide us with Google's signing keys... :)
[Android Software/Hacking General [Developers Only]] playahate:
so the last chance for the users with system that not boot is get into the second bootloader...

Number Start (sector) End (sector) Size Code Name
13 279552 281599 2048 0700 abootBackup

The main problem is - it seem to be available ONLY if the main bootloader is corrupted and the phone doesn't boot into bootloader.

There is a manual for restoring bootloader on Nexus 5, that claims that if you get to the second bootloader with Vol Up + Vol Down + Power, the adb shell is working there.

The next step for N5 is:

adb shell
su
dd if="/dev/block/mmcblk0p11" of="/dev/block/mmcblk0p6"

that command flash the abootb (aboot backup) to the main bootloader (aboot).

Don't know is the /sdcard is mounted in that case.

But if it is, then we can adb push the file to /sdcard and make the following lines to Nexus 6:

adb shell dd if=/sdcard/name_of_backup_with_oembit_changed_to_allow.img of=/dev/block/mmcblk0p18

If the storage is not mounted and not available - then we can do nothing and have bricked device...
[Android Software/Hacking General [Developers Only]] osm0sis:
test keys might work.

Edit: Nah, nevermind. Tried BootUnlocker and SuperSU (both are signed with test keys) in stock recovery and they fail whole-file.
[Android Software/Hacking General [Developers Only]] playahate:
[MENTION=4544860]osm0sis[/MENTION], can you make a test script for the N6? That only triggers that "oem ounlock bit"? got a device to test. a guy has working TWRP but i'm not sure for the system. maby its wiped, but we can try...
[Android Software/Hacking General [Developers Only]] osm0sis:
I've added this:

flounder*)
ui_print "Nexus 9: $device";
ui_print " ";
ui_print "Note: On this device the bootloader remains locked,";
ui_print "but 'fastboot oem unlock' will be enabled/disabled.";
block=`getprop ro.frp.pst`;
offset=524284;
locked=00;
unlocked=01;
hastamper=0;;

to the following test zip. Should work for your friend to try and unbrick. Let me know how it goes! :)

Edit: Attachment removed.
[Android Software/Hacking General [Developers Only]] playahate:
emm... We need the Nexus 6 script =)
[Android Software/Hacking General [Developers Only]] osm0sis:
Haha right. Can't make one without the offset though. We need dumps of frp before and after it's toggled to compare. ;)
[Android Software/Hacking General [Developers Only]] playahate:
Made a request on russian forum for those 2 files... But when the recovery is working we will try to flash the "triggered" .img file itself...

One of the 2 devices i mentioned before is bricked. Only fastboot is working.

The second device doesnt boot to system but has working TWRP.

fastboot format cache (and userdata) is working. :

SuperSU flashed succesfully ystd. But the system doesn't boot. He tried to push 3 diferent ROMs. 2 of them gives SUCCESS after 10 seconds (wery strange) with no errors (as he say). and thats it, still doesnt boot.

anyway i'll upload the files when we get them.

UPD: by the way...

Can we make it without images? We tknow that it must be last byte and we know the partition location:

Quote:

Number Start (sector) End (sector) Size Code Name
...
18 285696 286719 1024 0700 frp
...

That information is not enough for the offset?
[Android Software/Hacking General [Developers Only]] osm0sis:
We do not know it's the last byte. That's a bad assumption. We know that's how Nvidia did it, but they generally don't like to do things the same, so we can't risk it.

Edit: Also, no, as far as I know that information doesn't tell us the what the offset of the last byte would be. Either way, we need a dump of frp with the toggle on to know for sure.
[Android Software/Hacking General [Developers Only]] DiamondJohn:
Although tricker to install/get curl is more featured than wget; once you get it working. And its not a part of busybox
[Android Software/Hacking General [Developers Only]] osm0sis:
My Pixel 8 Pro arrives tomorrow... *rubs hands* 😁
[Android Software/Hacking General [Developers Only]] osm0sis:
Wow, turns out a lot of apps don't work anymore on Android 14/arm64-only like the Pixel 8 series... I'm looking for good, working alternatives to Terminal Emulator and aLogcat ROOT currently. 🤔

FX File Explorer's root functionality was broken, but I was able to work around it since it has a setting to choose the busybox in use, and mine works perfectly.

Similarly, Franco Kernel Manager (FKM) fails to fully open since it's shipping my arm busybox, but with a root file explorer you can hack it back onto life support by copying my arm64 busybox from /data/adb/modules/busybox-ndk/system/bin/busybox to /data/user/0/com.franco.kernel/files/busybox after the app has tried and failed to run a few times (to ensure it's dumped the arm busybox there). The flashing functionality will still be broken however since it relies on topjohnwu's not publicly released (and source unfortunately long lost) switchroot binary, and I believe it was only ever arm. EXKM will be in a similar boat.

A number of my modules ship only the arm binaries to try to keep zip size down, so I'll need to update them with arm64 as well. That includes adb/fastboot, nano, mtd-utils, zip/zipalign, and payload-dumper-go, as well as Flashlt since it relies on arm binaries for its function. 😬

Edit: On second look, AIK-mobile actually did install correctly and appears to work perfectly. 🤘😎
[Android Software/Hacking General [Developers Only]] rodken:
I wonder if the case that a good number of apps are misbehaving are using deprecated API's or apps that use native code that are not compiled for arm64 might not run on Android 14 / arm64-only devices or even apps that use libraries that are not compatible with Android 14 or arm64 will not work on Android 14 / arm64-only devices.

What say you?
[Android Software/Hacking General [Developers Only]] Lughnasadh:
This worked great! Thanks so much!
[Android Software/Hacking General [Developers Only]] peoeope:
Worked great for FKM!! Thanks so much, so happy I can continue to use it on my P8P :))
[Android Software/Hacking General [Developers Only]] osm0sis:
All of the above, yeah.

I mean somewhat use, yeah.
[Android Software/Hacking General [Developers Only]] BillGoss:
What about Termux? But get it from F-Droid, NOT the Play Store.

Termux | F-Droid - Free and Open Source Android App Repository

Terminal emulator with packages

f-droid.org
[Android Software/Hacking General [Developers Only]] osm0sis:
My whole thing has always been about getting stuff working on Android's built-in shell, so I would still like to avoid Termux and use something more bare-bones like Terminal Emulator if at all possible.
[Android Software/Hacking General [Developers Only]] HippoMan:
For years, I've been using JuiceSSH for terminal emulation. In addition to offering ssh capabilities, it also allows a "local" connection, which is simply a terminal emulator.

It might be over-kill for what you need, however.

And I have no idea whether it will work properly under A14.
[Android Software/Hacking General [Developers Only]] osm0sis:
Oh hey, by the way, if anyone needs them urgently, Surge already graciously provided arm64 binaries for adb and fastboot way back, so as a workaround until I can update the installer you can just grab them from his thread and replace adb.bin and fastboot.bin with them in /data/adb/modules/adb-ndk/system/bin, reboot and you're good to go.

Fastboot for ARM/ARM64

Here are the binaries for fastboot you can use on your device. The reason I'm posting them here is because they can really useful if you happen to flash something wrong while on the go. You need another device to connect to via USB to use them...

xdaforums.com
[Android Software/Hacking General [Developers Only]] osm0sis:
This is the current heir apparent of Terminal Emulator:

TermOne Plus - Apps on Google Play

Terminal emulator for Android

play.google.com

Clearing the "Initial command" and "Shell startup", and unchecking "Verify PATH entries" and "Collect PATH entries" in Preferences seems to get it behaving fully in line with what I expect. Changing Input Mode to Word-based is cool too but can be tricky at times with auto-correct.

Then `su -c pm grant com.termoneplus android.permission.READ_EXTERNAL_STORAGE` so TermOne Plus quits b*tching about it on every start.

Edit: Only downside I've noticed is that from being built with the newer minSdk it gets hosed by scoped storage for unrooted sdcard access. (e.g. to see the full contents of /sdcard/Download).

Edit 2: Just discovered that even with root not all is completely as expected... 🫤 You need to do `su -mm` to fully escape scoped storage, (e.g. to see the full contents of /data/data), due to the default Inherit Namespace setting of Mount Namespace Mode in Magisk's, but I wouldn't recommend changing that.

As for aLogcat/MatLog, there's only this one active fork, but oddly no APK was ever published:

Commits · shadergz/matlog

Material Logcat reader based on CatLog. Contribute to shadergz/matlog development by creating an account on GitHub.

github.com

I tried to get it to build but with no luck at my quick attempts.

So then Logcat Reader Professional seems decent (once milliseconds "Time format" is set in Settings, and "Use root privileges" and 500ms "Update interval" are set in Configure source), though unfortunately serves minor ads if you don't have an adblocker or the "Ultra" version:

[APP][5.0+] Logcat Reader Professional – Advanced log reader for Android

Logcat Reader Professional is a log reader that offers desktop-quality filtering options and clarity, aimed at both developers and experienced users. Features (Free) Simple and intuitive user interface App and log level per entry immediately...

xdaforums.com

Edit: It's still a little janky where it's a "prettied," processed logcat output instead of the actual original lines. The stackable log filter options are very cool.

Edit 2: "Ultra" limitations have since been removed by the developer! 🙌
[Android Software/Hacking General [Developers Only]] DiamondJohn:
I currently build A13 crDroid and Alpha from source. I cant remember which one (or possibly both), but I explicitly modify it not to build in Matlog. I have a Pixel 4A running A13 (ie not forced 64b). Maybe it is 64b? have you tried to get a hold of their version from the ROM?

Personally, I tend to use the output directly from the shell, and filtering via a clear before a log and a simple text filtering (grep) After the fact, or the logcat built in filtering.
[Android Software/Hacking General [Developers Only]] DiamondJohn:
Just saw, you can grab it from F-Droid

MatLog Libre | F-Droid - Free and Open Source Android App Repository

Material Design logcat reader based on CatLog

f-droid.org
[Android Software/Hacking General [Developers Only]] osm0sis:
Libre doesn't work in exactly the same way the Play Store version doesn't: infinite spinner. 🤷‍♂️

Of course I can just use the logcat command in a terminal emulator, but having an app with advanced filtering is certainly a nice-to-have. 😆

Edit: Final plot twist, even though aLogcat ROOT is delisted/showing incompatible on the Play Store, restoring it from Swift Backup works and it runs correctly! 🧐😲
[Android Software/Hacking General [Developers Only]] DiamondJohn:
Thats unusual, I got the link from HIS own github page.

GitHub - shadergz/matlog: Material Logcat reader based on CatLog

Material Logcat reader based on CatLog. Contribute to shadergz/matlog development by creating an account on GitHub.

github.com

He also has it on the PlayStore, where the reviews are far from shining.

Thats a win!
[Android Software/Hacking General [Developers Only]] osm0sis:
You're looking at the official MatLog links in the readme, which is on Play Store/F-Droid, which is SnowVolf's main repo not that fork, and is the broken one. Presumably arm64-only devices haven't taken over in the reviews yet... 😉
[Android Software/Hacking General [Developers Only]] Monkeysss01:
Could you share the version of BusyBox you used? Thanks
[Android Software/Hacking General [Developers Only]] Lughnasadh:
The one in the OP.
[Android Software/Hacking General [Developers Only]] bege10:
@osm0sis

The URL in the update.json of TWRP retention script does not exist any more. I fount the code in this repo https://github.com/Magisk-Modules-Repo/twrp-keep and putting it into a zip file and flashing it in Magisk works correct. But there is no package for download. Could you, please, update the update.json and provide a package?

Thank you very much for your work!
[Android Software/Hacking General [Developers Only]] osm0sis:
The current zip is linked in the OP as always, and yeah, I'll update the json link; must have gotten broken in the xdaforums rebrand or something.
[Android Software/Hacking General [Developers Only]] bege10:
I don't find an attachment for this script in the OP but a link to a post. The attachment there is not up to date (contains no update.json).
[Android Software/Hacking General [Developers Only]] osm0sis:
Yes, some things get their own post. Modules don't contain update.json. It's up to date.
[Android Software/Hacking General [Developers Only]] bege10:
Sorry for being persistent. The code in Magisk Modules Repo has an update.json and the code is different from the attachment in TWRP A/B Retention Script Zip Module
[Android Software/Hacking General [Developers Only]] osm0sis:
The code is not different, I just compared it. The attachment is up-to-date. Module zips don't contain the update.json, only the repos do.

Anyway, I just updated the update.json, links and attachment again with the new xdaforums.com URLs just to be certain, and all should definitely work as per the README now.
[Android Software/Hacking General [Developers Only]] bycolxxiv:
Hey everyone!

Just a short question... I'm about to root my device systemless via magisk, but I still need TWRP afterwards to setup MicroG services.

Will your (@osm0sis) script still preserve the TWRP installation? Or is this only possible on a system root setup when I flashed the patched magisk boot via TWRP instead of fastboot?

Cheers and thanks in advance!
[Android Software/Hacking General [Developers Only]] osm0sis:
My TWRP addon.d-v2 script is for ROMs on recovery-as-boot A/B slot devices that support addon.d, you simply put it into /system/addon.d (if your ROM doesn't have this it's probably not supported) per the instructions, and currently requires Magisk.

For your initial Magisk install you'll need to install Magisk from in TWRP after TWRP has been flashed, boot the ROM then Direct Install Magisk again. Alternately, you could dump the boot.img after TWRP has been flashed, then Patch it in Magisk while booted, then flash it and place Magisk's addon.d script manually. After that place the TWRP addon.d-v2 script and all should be good!
[Android Software/Hacking General [Developers Only]] bycolxxiv:
First of all, thanks for the quick reply!

So my plan was the following:

- push magisk apk via adb, install apk, patch boot img

- reboot to bootloader, flash patched boot img via fastboot

-> systemless root

Then sometime later:

- boot to bootloader, flash twrp

-> twrp setup (hopefully permanent)

Now twrp wasn't used to root the phone or install magisk, both were installed independently.

In this case, would your script still work as it's supposed to?

Or do I HAVE to flash magisk via twrp and do a system root?

Of course I'd still install the script as prescribed by the instructions!
[Android Software/Hacking General [Developers Only]] osm0sis:
If TWRP is there in the boot.img, the script will preserve it, regardless of install method. (y)

Side note, as people may not have realized this yet, but for devices that have a separate recovery partition, my FlashAfterUpdate addon.d script can be used to simply flash the TWRP .img to recovery again after each update.
[Android Software/Hacking General [Developers Only]] bycolxxiv:
Thanks again, that's great news!

No one last question... My phone doesn't seem to have a /system/addon.d folder. Is there any other way the script could still work?

I've read about the option of installing the scripts zip file via magisk. Will this work? I'm fine with installing the script again for every OTA if that's the case.

Or is there any other way to use the script without an existing /system/addon.d directory?
[Android Software/Hacking General [Developers Only]] HippoMan:
Just out of curiosity: does everything mentioned here that works under TWRP also work under OrangeFox?
[Android Software/Hacking General [Developers Only]] osm0sis:
If your ROM doesn't have addon.d then the addon.d script will not work. Use a different ROM with addon.d support (Lineage-based is usually the best bet), or you could try my TWRP A/B Retention Script Magisk module (intended more for Stock ROMs). If you're using a custom ROM already though, I wouldn't want one without addon.d just for the ease of use between updates with Magisk's addon.d script reflashing itself, etc.
[Android Software/Hacking General [Developers Only]] osm0sis:
They all rely on finding twres in the ramdisk root for detection; IIRC OrangeFox has that too as a fork of TWRP, so should be good.
[Android Software/Hacking General [Developers Only]] bycolxxiv:
Thanks so much for the help!

As I'm using a pretty stock ROM I'll be looking into the module you mentioned!

This one I'm gonna have to install every time I do an OTA right?

Or is there a way to permanently install the module so that it will preserve TWRP every OTA?
[Android Software/Hacking General [Developers Only]] osm0sis:
You install it after an OTA, then manually "update" it in Magisk's modules list to run it again after every OTA. Check the module instructions for more detail. :)
[Android Software/Hacking General [Developers Only]] bycolxxiv:
That's all I needed, thank you so much for your help and the great development work you're contributing to the community! (:
[Android Software/Hacking General [Developers Only]] BillGoss:
@osm0sis,

Quick question: I noticed that in your adb/fastboot module you check that the user is running as root before running a fastboot command. You don't do that for adb commands, so why is this required for fastboot?
[Android Software/Hacking General [Developers Only]] osm0sis:
`start adbd` is a root check in itself, so both have them and require them.