[Huawei Mate 9 Questions & Answers] duraaraa:
Ok, so. Here is what I have. I've been up all night, it's 7AM, and I'm tired, so I'm not going to be working on this any more until tomorrow. If any of you can find the solution to this, I can very likely let you flash whatever version you want onto your phone. This will be a long explanation, but if anyone is knowledgeable about openssl, they can help me hack at this.

Here is a response from a request to huawei's authorization server for B115, which can be flashed.

data=eyJ1cGRhdGVUb2tlbiI6Ijc1M0Q4QUYwMDAwNzFBQkMiLCJkZXZpY2VJZCI6IjU5OTg0RUJBQ0U5MkI3REJBQkQxMzUwQTk4NDgzQzlDM0U3MTYyRjMxMDExNDk0QjQ2REFFNkU4MjJEMkM0OEIiLCJhcHByb3ZlZFZlcnNpb25MaXN0IjpbeyJ2ZXJzaW9uSWQiOiI2NjcxMSIsInN0YXR1cyI6IjAiLCJ2ZXJzaW9uTnVtYmVyIjoiTUhBLUwyOUM5MDBCMTE1In1dfQ==&sign=MEUCIF1DGCXm0VPxuBa2qdBfGr98haEasb3yMcCVr+lYbHrBAiEAyZn3Wi1vlD9ZeWQDWeTt9kE7a9YJhFR2b01nG/FDlWI=&cert=MIIDJzCCAsygAwIBAgIJALWcScNmfs+NMAoGCCqGSM49BAMCMIHXMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHSmlhbmdzdTEQMA4GA1UEBwwHTmFuamluZzEsMCoGA1UECgwjSHVhd2VpIFNvZnR3YXJlIFRlY2hub2xvZ2llcyBDTy5MdGQxQTA/BgNVBAsMOERldmllIFJlZ2lvbiBEZWxpdmVyeSAmIFNlcnZpY2UgUXVhbGl0eSAmIE9wZXJhdGlvbiBEZXB0MRQwEgYDVQQDDAtPVEEgUm9vdCBDQTEdMBsGCSqGSIb3DQEJARYOb3RhQGh1YXdlaS5jb20wHhcNMTYwNzEyMDgxOTU5WhcNMTcwNzEyMDgxOTU5WjCB2zELMAkGA1UEBhMCQ04xEDAOBgNVBAgMB0ppYW5nc3UxEDAOBgNVBAcMB05hbmppbmcxLDAqBgNVBAoMI0h1YXdlaSBTb2Z0d2FyZSBUZWNobm9sb2dpZXMgQ08uTHRkMUEwPwYDVQQLDDhEZXZpZSBSZWdpb24gRGVsaXZlcnkgJiBTZXJ2aWNlIFF1YWxpdHkgJiBPcGVyYXRpb24gRGVwdDEYMBYGA1UEAwwPT1RBIEF1dGggU2VydmVyMR0wGwYJKoZIhvcNAQkBFg5vdGFAaHVhd2VpLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGeDtAUO4uTY5yWwS54sk030WOdHYoaaO0dufn4jvul22Ytogvua1W0qY+ABblhA3eB49YXYPnpLvGhjr+73oZ6jezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBTGCe/51LIS2ZT9nAj06RaAFcQa4jAfBgNVHSMEGDAWgBTH3T3aib5XZtlRccAInw7VjXJS0jAKBggqhkjOPQQDAgNJADBGAiEAjyic8z59ws8PvB2Q7apf69yFLM7ByICD8RBXxmz1WtUCIQChb2PYP5BzGRFxKV9ow9DesWt4bakIgdNFsUuT4NwMlQ==

We can split this up into three parts. All of them are base64. so the first part, from data= to &sign= can be translated to plain text, which gives us this json:

{"updateToken":"753D8AF000071ABC","deviceId":"59984EBACE92B7DBABD1350A98483C9C3E7162F31011494B46DAE6E822D2C48B","approvedVersionList":[{"versionId":"66711","status":"0","versionNumber":"MHA-L29C900B115"}]}

The sign= portion is a signature, and the cert= portion is an openssl certificate.

I have determined that all or part of the data= portion is signed with the certificate in the cert= portion. But I don't know in what shape the data is signed. If I convert everything and check with openssl, verification fails. I hope that someone can run some experiments and figure out exactly what it is in that data which is signed. If you can find this, I can help you get whatever version loaded you want.

By the way, here's what happens when we try to request B126:

data=eyJ1cGRhdGVUb2tlbiI6Ijc1M0Q4QUYwMDAwNzFBQkMiLCJkZXZpY2VJZCI6IjU5OTg0RUJBQ0U5MkI3REJBQkQxMzUwQTk4NDgzQzlDM0U3MTYyRjMxMDExNDk0QjQ2REFFNkU4MjJEMkM0OEIiLCJhcHByb3ZlZFZlcnNpb25MaXN0IjpbeyJ2ZXJzaW9uSWQiOiI2ODE2NSIsInN0YXR1cyI6IjEifV19&sign=MEUCIBrO1Y0ko3+fb12yXewessLbe3lfg5XPoPoqL30G5XMtAiEA9WniyB0vNRZWREk2vYT3Dfq9hPUJMNC8miAdlkULCe0=&cert=MIIDJzCCAsygAwIBAgIJALWcScNmfs+NMAoGCCqGSM49BAMCMIHXMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHSmlhbmdzdTEQMA4GA1UEBwwHTmFuamluZzEsMCoGA1UECgwjSHVhd2VpIFNvZnR3YXJlIFRlY2hub2xvZ2llcyBDTy5MdGQxQTA/BgNVBAsMOERldmllIFJlZ2lvbiBEZWxpdmVyeSAmIFNlcnZpY2UgUXVhbGl0eSAmIE9wZXJhdGlvbiBEZXB0MRQwEgYDVQQDDAtPVEEgUm9vdCBDQTEdMBsGCSqGSIb3DQEJARYOb3RhQGh1YXdlaS5jb20wHhcNMTYwNzEyMDgxOTU5WhcNMTcwNzEyMDgxOTU5WjCB2zELMAkGA1UEBhMCQ04xEDAOBgNVBAgMB0ppYW5nc3UxEDAOBgNVBAcMB05hbmppbmcxLDAqBgNVBAoMI0h1YXdlaSBTb2Z0d2FyZSBUZWNobm9sb2dpZXMgQ08uTHRkMUEwPwYDVQQLDDhEZXZpZSBSZWdpb24gRGVsaXZlcnkgJiBTZXJ2aWNlIFF1YWxpdHkgJiBPcGVyYXRpb24gRGVwdDEYMBYGA1UEAwwPT1RBIEF1dGggU2VydmVyMR0wGwYJKoZIhvcNAQkBFg5vdGFAaHVhd2VpLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGeDtAUO4uTY5yWwS54sk030WOdHYoaaO0dufn4jvul22Ytogvua1W0qY+ABblhA3eB49YXYPnpLvGhjr+73oZ6jezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBTGCe/51LIS2ZT9nAj06RaAFcQa4jAfBgNVHSMEGDAWgBTH3T3aib5XZtlRccAInw7VjXJS0jAKBggqhkjOPQQDAgNJADBGAiEAjyic8z59ws8PvB2Q7apf69yFLM7ByICD8RBXxmz1WtUCIQChb2PYP5BzGRFxKV9ow9DesWt4bakIgdNFsUuT4NwMlQ==

The data portion translates to the following json:

{"updateToken":"753D8AF000071ABC","deviceId":"59984EBACE92B7DBABD1350A98483C9C3E7162F31011494B46DAE6E822D2C48B","approvedVersionList":[{"versionId":"68165","status":"1"}]}

You will notice that the status in the working update was 0. It also gave a version. In this case, we get status 1 and no version. Ergo, authentication fails and it will not install through eRecovery or HiSuite, while version B115 will.

So if you can find out what is signed and how, I might be able to re-sign this stuff and just provide/generate the certificate/key via my DNS server so that the installations no longer fail.

That is where I'm at. If anyone can crack the code, please post it here.