[Android Software/Hacking General [Developers Only]] deliad:
Hi

I'm writing in the names of all Meizu PRO 5 Owners.

Most of us tried to flash custom recovery after downgrading the rom which downgrade the bootloader to unlockable version.

Then we unlocked it Simply with

fastboot oem unlock

.

Everything was fine untill we flashed custom recovery and after we flashed the latest meizu rom, which flashes NOT UNLOCKABLE BOOTLOADER BACK TO THE PHONE AND ERASES RECOVERY!

In that state - we fakd up, we stuck on rom without recovery and with not unlockable bootloader.

for some and many of the users the phone can act as a door stopper.

fastboot oem unlock

gets permission denied, and flash recovery with fastboot gets the same - permission denied Aka Operation not Permitted.

This pro 5 is a samsung galaxy s6 like specs, it has Exynos 7420 4gb RAM.

We have a leaked internal tools of Meizu ODIN Like, which they are not supported the new bootloader, flash from there requires signing the files with the right token, and the tool doesnt know to do that on the new Bootloader.

new tools is not an option now and meizu doesn't want to help us, they want take money for "board replacement"..

I Know that a solution can be found!:

NOTE: THE NEW BOOTLOADER CAN BE UNLOCKED VIA FASTBOOT! - IF WE WILL GIVE THE RIGHT TOKEN KEYS TOGETHER.

bootloader unlock key is total 512 bytes key and we can insert it each time divided by 16 bytes each by using fastboot oem unlock [16 bytes key part here].

i can get the token for bootloader with:

fastboot oem random

which generates key like this:

F19A38EE437B8C21DD49A6BF2BC47E24

(bootloader) F19A38EE437B8C21DD49A6BF2BC47E24
OKAY [ 0.005s]

So the only thing we have to do to make this done is:

1. get key from the current bootloader and then think about the token key generation scheme and then get the bootloader completely unlocked.

and IF NOT, we can reverse engineer the new bootloader.

SO THE QUESTION IS:

Can you help us generate the unlock key from the token?

I know how we insert the unlock key back, its something like this

fastboot oem verify:[32 divded characters of the key string goes here]

total should be 16 commands like this so its should be 512 characters key.

HERE IS AN EXAMPLE OF SUCCESSFULL PHONE UNLOCK BY MEIZU - I took this from meizu's tool logs

these logs are actually showing device unlock, format, reflash,relock bootloader

==============================================================================

===========================================================
| Trace On
===========================================================
[09:52:44:926]Tips: Device insert. ID: 04358ca68588 [B]this is the meizu device serial[/B]
[09:52:45:378]Token sign operator. Begin -----------------------------
[09:52:45:379]Tips: Token signing...
[09:52:45:380]Read uboot serial. Command: fastboot -s "04358ca68588" oem random [B]here it asks for a random key from the phone - EACH TIME this command is executed - the phone generates new key![/B]
[09:52:45:476]...
(bootloader) 8F32FB562DB8D34F1E75E97C17E85218 [B]so thats the key we got from the phone[/B]
OKAY [ 0.001s]
finished. total time: 0.001s
[B]thats the key that meizu servers replied back - 512 characters key [/B]
[09:52:56:027]6FF64BAE41517CEBFB3AD2A873DC472BA7E09D57151917452D13F0FCB1C38CAD6D3C7688B2D4EA646E32EA0150419AD3E7018BC987CCBC531874A213970E8334B641F2D6BF813A9E0A9857FA187FFB6FFFA9DD5CD083703ECC131E2E8E4A4D14936DC364B361C68E26079ED6E070CF36691F1DC1AE2FD3593688EB9D3F9341991FBF298BF8117127AD334E72D94E0D7D2E9DE104973F06BFF42734CD3E2641A50907CEDC40DBD77AC3E44B686A5A24DE3FDBAC68C322876BFF1AD322D04A933EEFACB28CA011D216ABC8F26CBE9A5A0C1EC38192DE9E3E08F2CF168173C1F12A7F5BCD8B451B711A769CF8D581152822BA02A3890A4037F02F38685752C786A6
[09:52:56:027]fastboot -s "04358ca68588" oem verify:6FF64BAE41517CEBFB3AD2A873DC472B [B]1st 32 characters inject of 512[/B]
[09:52:56:124]...
(bootloader) 16
OKAY [ -0.000s]
finished. total time: -0.000s

[09:52:56:124]fastboot -s "04358ca68588" oem verify:A7E09D57151917452D13F0FCB1C38CAD [B]SO ON...[/B]
[09:52:56:220]...
(bootloader) 32
OKAY [ 0.000s]
finished. total time: 0.000s

[09:52:56:220]fastboot -s "04358ca68588" oem verify:6D3C7688B2D4EA646E32EA0150419AD3 [B]SO ON...[/B]
[09:52:56:316]...
(bootloader) 48
OKAY [ 0.000s]
finished. total time: 0.000s

[09:52:56:316]fastboot -s "04358ca68588" oem verify:E7018BC987CCBC531874A213970E8334 [B]SO ON...[/B]
[09:52:56:413]...
(bootloader) 64
OKAY [ -0.000s]
finished. total time: -0.000s

[09:52:56:413]fastboot -s "04358ca68588" oem verify:B641F2D6BF813A9E0A9857FA187FFB6F [B]SO ON...[/B]
[09:52:56:510]...
(bootloader) 80
OKAY [ -0.000s]
finished. total time: -0.000s

[09:52:56:510]fastboot -s "04358ca68588" oem verify:FFA9DD5CD083703ECC131E2E8E4A4D14 [B]SO ON...[/B]
[09:52:56:606]...
(bootloader) 96
OKAY [ -0.000s]
finished. total time: -0.000s

[09:52:56:606]fastboot -s "04358ca68588" oem verify:936DC364B361C68E26079ED6E070CF36 [B]SO ON...[/B]
[09:52:56:703]...
(bootloader) 112
OKAY [ 0.000s]
finished. total time: 0.000s

[09:52:56:703]fastboot -s "04358ca68588" oem verify:691F1DC1AE2FD3593688EB9D3F934199 [B]SO ON...[/B]
[09:52:56:799]...
(bootloader) 128
OKAY [ -0.000s]
finished. total time: -0.000s

[09:52:56:799]fastboot -s "04358ca68588" oem verify:1FBF298BF8117127AD334E72D94E0D7D [B]SO ON...[/B]
[09:52:56:896]...
(bootloader) 144
OKAY [ 0.001s]
finished. total time: 0.001s

[09:52:56:896]fastboot -s "04358ca68588" oem verify:2E9DE104973F06BFF42734CD3E2641A5 [B]SO ON...[/B]
[09:52:56:993]...
(bootloader) 160
OKAY [ 0.001s]
finished. total time: 0.001s

[09:52:56:993]fastboot -s "04358ca68588" oem verify:0907CEDC40DBD77AC3E44B686A5A24DE [B]SO ON...[/B]
[09:52:57:090]...
(bootloader) 176
OKAY [ 0.001s]
finished. total time: 0.001s

[09:52:57:090]fastboot -s "04358ca68588" oem verify:3FDBAC68C322876BFF1AD322D04A933E [B]SO ON...[/B]
[09:52:57:186]...
(bootloader) 192
OKAY [ -0.000s]
finished. total time: -0.000s

[09:52:57:186]fastboot -s "04358ca68588" oem verify:EFACB28CA011D216ABC8F26CBE9A5A0C [B]SO ON...[/B]
[09:52:57:283]...
(bootloader) 208
OKAY [ 0.000s]
finished. total time: 0.000s

[09:52:57:283]fastboot -s "04358ca68588" oem verify:1EC38192DE9E3E08F2CF168173C1F12A [B]SO ON...[/B]
[09:52:57:379]...
(bootloader) 224
OKAY [ 0.001s]
finished. total time: 0.001s

[09:52:57:379]fastboot -s "04358ca68588" oem verify:7F5BCD8B451B711A769CF8D581152822 [B]SO ON...[/B]
[09:52:57:476]...
(bootloader) 240
OKAY [ 0.001s]
finished. total time: 0.001s

[09:52:57:476]fastboot -s "04358ca68588" oem verify:BA02A3890A4037F02F38685752C786A6 [B]SO ON...[/B]
[09:52:57:668]...
(bootloader) 256
(bootloader) verify success [B]PHONE'S BOOTLOADER IS FINALLY UNLOCKED![/B]
OKAY [ 0.128s]
finished. total time: 0.128s

[09:52:57:670]Tips: Token singed successfully
[09:52:57:670]Token sign operator. End -----------------------------
[09:52:57:672]Tips: Format part
[09:52:57:672]fastboot -s "04358ca68588" oem cmd "scsi erase 0 0x80000 0" [B]When the bootloader is unlocked - they use cmd to shell command for formating the partition[/B]
[09:53:01:948]...
OKAY [ 4.242s]
finished. total time: 4.242s

[09:53:01:951]Tips: Format part. ok
[09:53:01:953]Tips: Partition disk
[09:53:01:953]fastboot -s "04358ca68588" oem cmd "fdisk -c 0" [B]repartitioning[/B]
[09:53:02:145]...
OKAY [ 0.132s]
finished. total time: 0.132s

the rest is locking the bootloader again - not interested....

the problem is that the token generation is done on meizu servers, and we unable to get access to there...

Maybe because we know example of token generation we can in way of bruteforce to find the correct token generation formula for the random key that i generated?

Please devs , join this discussion,Then we can help alot users to enjoy their phone again