yashsingh1/xdaforums huggingface dataset:
[Google Pixel XL Questions & Answers] LoliSmith:
That's what keymaster is?

Then I wouldn't flash it.

I want to upgrade it, lock it and be able to unlock it again. I thought by leaving aboot and it looks like keymaster on 7.1, then I could upgrade everything else to 7.1.1. and lock. Then flash back to stock 7.1 and unlock again using depixel8 should I ever want to.

I realize I am sailing in uncharted waters and could brick the phone.

Thanks, I would return it to stock 7.1 before trying to use depixel8 again.

Thanks for the warning. I flashed all kinds of mismatched system partitions, kernels and radios to my Moto X 2014 and Moto X 2013, never bricked once as long as I did not upgrade the bootloader and the partition table. Maybe I got lucky but as long as the bootloader and partition table matched and I didn't upgrade the bootloader, I could selectively flash with impunity even with a locked bootloader. The Moto X 2013 was bootloader unlocked but the Moto X 2014 was not.

Of course, neither of those devices were on Marshmallow or Nougat.

I know it won't work on the pixel, I was just mentioning it because you said rarely was selective flashing smart and MoFo was an example of when it was a good thing to selectively flash.

I got a great deal on this Pixel so I won't be out a lot of money if I brick it. I don't love this phone anyhow - only 32GB with no SD card, no waterproofing, no wireless charging and it has huge bezels. Not to mention the fact that it isn't even black. I mean WTF? They named it Quite Black and it is like an ugly dark gray with kind of a brownish tint. Not attractive at all.
[Google Pixel XL Questions & Answers] LoliSmith:
That is so Apple-like. Apple doesn't let you unlock but still, enforcing policies like that through an OEM server is very Apple-like.
[Google Pixel XL Questions & Answers] jcase:
Mofo isnt an example of selectively flashing.

Look, as far as I can tell you are just trying to make things hard on yourself.

If you want unlocked, leave it unlocked.

If you dont then flash stock and lock it
[Google Pixel XL Questions & Answers] jcase:
Not applie like at all
[Google Pixel XL Questions & Answers] LoliSmith:
I know what MoFo is. My point was that those of us who paid for MoFo engaged in selective flashing so that we could update our system partitions to newer versions of the OS but still have root. The way we accomplished that was by not upgrading the bootloader and the partition table so that MoFo would still work for us.

It isn't a matter of making things hard. I want to try things out. I like doing things like this, it's a hobby for me.
[Google Pixel XL Questions & Answers] bobby janow:
Would that mean that the IMEI is the determining factor? Or is it some other hardware trigger? You can really put a lot of speculation to rest once and for all.
[Google Pixel XL Questions & Answers] LoliSmith:
Like what, WiFi MAC Address?
[Google Pixel XL Questions & Answers] jcase:
Sounds like something that would be educational and fun for you two to reverse out of the pixel firmware

You dont know what mofo is apparently.
[Google Pixel XL Questions & Answers] bobby janow:
How did I know you were going to say that?
[Google Pixel XL Questions & Answers] jcase:
because it is the best answer to give someone, it makes them learn, and informs them your not going to spoon feed them fine grain details of everything, when the follow the suggestion they end up learning a lot more
[Google Pixel XL Questions & Answers] LoliSmith:
Yes I do. MoFo was a modified fastboot that wrote too much to the cache partition and the overflow wrote to the system partition. So we could flash pre-rooted images to system because they were padded by MoFo and overflowed the cache.

https://xdaforums.com/showpost.php?p=61672253&postcount=4

The exploit was closed with the 5.1 bootloader so that is why we stayed on the kitkat bootloader. We could flash pre-rooted 5.1 system images as long as our bootloaders and partition tables stayed on the kitkat bootloader.
[Google Pixel XL Questions & Answers] LoliSmith:
It's got to be based on IMEI, S/N or WiFi MAC Address. Those are the 3 unique device identifiers.
[Google Pixel XL Questions & Answers] jcase:
No, no you don't. It isnt a modified fastboot, fastboot wasn't written in python, mofo was.
[Google Pixel XL Questions & Answers] LoliSmith:
Ok, whatever, the concept was the same regardless of the code used to execute it. We created pre-rooted system images and MoFo padded them with enough data to overflow the cache and wrote them to the cache. The padding was the same size as the cache and once the cache overflowed, the pre-rooted system images were written to the system partition. Then the cache was erased by MoFo.
[Google Pixel XL Questions & Answers] bobby janow:
Could it not be software? If it were hardware only then the 7.1 version could be locked also no matter the image.
[Google Pixel XL Questions & Answers] LoliSmith:
I have a Pixel on 7.1 that I unlocked the bootloader using depixel8. In the developer options, the OEM unlocking is grayed out despite my bootloader being unlocked.

Today, a guy posted that he bought a Verizon Pixel and it was on 7.1.1 but for some reason, the OEM unlocking wasn't grayed out and he was able to unlock.

https://xdaforums.com/pixel/help/phone-verizon-7-1-1-unlockable-t3577438

And apparently others on reddit had the same thing happen to them. So yeah, I guess the firmware is a big part of it because if the OEM unlocking is not grayed out, you can unlock the Verizon Pixels.
[Google Pixel XL Questions & Answers] LoliSmith:
I guess it could be both. Obviously some Verizon Pixels are leaving the factory with firmware that allows the OEM unlocking to be turned on in the Developer Options and they can be unlocked. Jcase says they have to communicate with the google servers to be unlocked so that to me indicates that the google servers check a unique device identifier.

I am guessing that the factory is working hard trying to meet demand for the devices and the factory is screwing up. I doubt that Verizon is OK with this, I think this is a mistake at the factory.
[Google Pixel XL Questions & Answers] bobby janow:
I actually think some of the Verizon replacement phones are in fact Google phones. They might have run out and need to replace them with whatever they have. But I do agree it might be a combination of firmware and software.

Now if the actual Verizon 7.1 devices still have the option greyed out yet can, with software, be unlocked then what was the exploit? Hardware or software? And how did they close it up? What did depixel8 do, modify the firmware in bootloader? We already know that the system software was not modified. Zzzz tomorrow.
[Google Pixel XL Questions & Answers] LoliSmith:
This wasn't a replacement phone. The guy purchased it from Verizon yesterday, it came with 7.1.1:

https://xdaforums.com/showpost.php?p=71543359&postcount=9

Mine is on 7.1 with the option grayed out. Depixel8 allowed me to unlock. Option is still grayed out despite being unlocked.

Jcase said depixel8 uses a low level bootloader exploit. He also said Pixels communicate with the google servers to tell them whether they can be unlocked or not. But I don't think I ever have put an active SIM card in this phone.

Depixel8 does not unlock your bootloader, you still have to run fastboot OEM unlock.

I guess I could relock and then rerun depixel8 to see if there is any info on the screen during depixel8 that would help to figure this out. I can't remember if I had an inactive SIM card in the phone when I unlocked it or not.
[Google Pixel XL Questions & Answers] jcase:
I didnt discuss how depixel8 works at all.

You wont get any info on the screen at all
[Google Pixel XL Questions & Answers] LoliSmith:
http://www.securitybsides.com/w/page/112154857/BsidesSeattle2017

"This talk will cover the three low level bootloader vulnerabilities we found and exploited during the first week of Pixel release. "
[Google Pixel XL Questions & Answers] jcase:
Yes It was my talk, I was there, none of those three were dePixel8.
[Google Pixel XL Questions & Answers] LoliSmith:
My Pixel is on 7.1 and literally fresh out of the box, no OTAs of any kind have been taken and no flashing. If I relock my bootloader, I will be able to use depixel8 to unlock it again, yes?
[Google Pixel XL Questions & Answers] jcase:
see http://theroot.ninja/depixel8.html
[Google Pixel XL Questions & Answers] LoliSmith:
That doesn't answer my question. The device is stock 7.1 with an unlocked bootloader I just factory reset it because it has nothing on it anyhow. I have never even had an active SIM card in it. I don't think I ever even had an inactive SIM card in it. Just connected via WiFi to activate it. I have never taken any OTA, never flashed anything.

If I lock it, I should be able to use depixel8 to unlock it again, yes? Or are you saying no, once it is unlocked it can never be relocked and unlocked again no matter what firmware/bootloader you are running?

Or are you saying, you don't know what will happen so if I relock, even though I never took an OTA, never used the phone, never flashed anything, you just can't say what will happen if I try to use depixel8 again to unlock because you don't know?
[Google Pixel XL Questions & Answers] aholeinthewor1d:
"dePixel8 is patched in Android 7.1.1 and newew"

Yes you can unlock again if on 7.1
[Google Pixel XL Questions & Answers] bobby janow:
Otherwise he would have said, "depixel8 is patched in bootloader version xxx and newer" which he did not do. Bottom line I believe his message was don't try it or you're on your own.

But back to his challenge of reverse engineering the firmware.. I'd have no clue even where to begin. So we have software embedded in hardware that is talking to Google servers. Come on man put on your thinking cap. If it could be done then he would do it but the challenge is to find out what it is that communicates with the servers.
[Google Pixel XL Questions & Answers] LoliSmith:
That's his message if you use depixel8 at all. depixel8 is unsupported.

But I agree, he is being cryptic and is implying that if you relock after unlocking even if you stay on 7.1 and don't upgrade you can't re-unlock. At least that is the way I am reading it.
[Google Pixel XL Questions & Answers] bobby janow:
Yes, I believe that too. But you really do want to update at some point right? Fixes, security updates etc. At that point you would need to decide one way or the other. If you never upgrade then you can go back and forth. But to what end? Why constantly wipe the device if you don't have anything to change?

I don't think he's being cryptic as much as "not spoon feeding" us what he has taken many hours of work to learn. I do understand that and it is a challenge for sure. Wouldn't mind a starting point, however. I'm clueless at this point even where to begin to reverse engineer firmware.
[Google Pixel XL Questions & Answers] LoliSmith:
Believe what? That once you relock regardless of whether or not you stay on 7.1, you can't re-unlock?

So you think I can unlock using depixel8, relock on 7.1, stay on 7.1 never upgrade and use depixel8 again to re-unlock?

He is being cryptic for whatever reason, he doesn't want to reveal how depixel8 works. This isn't a matter of spoon feeding me, I have no way of knowing how depixel8 works without reverse engineering it.

What firmware are you talking about? The Pixel bootloader?
[Google Pixel XL Questions & Answers] aholeinthewor1d:
He never said that. It's very clear right on the site he linked. It's patched in 7.1.1 and later. If you are on 7.1 you can lock and unlock again. I've been on these forums since the beginning and lots of people have done it. It's highly discouraged to lock again because if somehow you get updated to 7.1.1 you are screwed. Also if you lock without being completely stock you could be bricked. I think there is just miscommunication. One thing that is 100% positive and pasted all over the forums is that if you are on 7.1 you can u lock. Doesn't matter if you unlocked previously. All that matter is if you are on 7.1. If you are then you can unlock
[Google Pixel XL Questions & Answers] LoliSmith:
Ok, gtk, thanks.

Thanks.
[Google Pixel XL Questions & Answers] bobby janow:
1. No. You can unlock if you stay on 7.1

2. Yes

3. I wasn't talking about how depixel8 works really. Just what determines whether the option is grayed out or not. So I meant the firmware of the device specifically.

4. The firmware of the device. The bootloader has nothing to do with anything. Google and Verizon bootloaders are the same yet one can be unlocked and one cannot.
[Google Pixel XL Questions & Answers] LoliSmith:
I think the Verizon bootloaders flashed at the factory are different from the Google bootloaders flashed at the factory. The former won't respond to the fastboot OEM unlock command and the latter will.

I don't think they are. The only way to know that is to reverse engineer them and neither of us have done that.
[Google Pixel XL Questions & Answers] bobby janow:
They won't respond to the oem unlock command because you can't enable that in dev options. If you turn off the switch on a Google device you can't unlock either until you reenable it. That is irrespective of the bootloader version.

The reason I say they are the same is because Google devices and Verizon devices only have one factory image for the both of them. They have to be the same. But back in 7.1 at some point there were 2 separate I believe. Users with a VZW phone tried to flash the Google image in order to get the switch to toggle and it still wouldn't. That image included the bootloader too.
[Google Pixel XL Questions & Answers] LoliSmith:
If there is only 1 aboot.img version for both Verizon and Google Pixels, then it has to be implemented at a lower level than aboot.

http://newandroidbook.com/Articles/aboot.html

http://newandroidbook.com/TOC.html#boot

https://source.android.com/security/verifiedboot/index.html

https://source.android.com/security/verifiedboot/verified-boot.html
[Google Pixel XL Questions & Answers] bobby janow:
Exactly! Now let's figure out where. That's what I was trying to pull out of JCase, thus the spoon feeding chastisement.
[Google Pixel XL Questions & Answers] LoliSmith:
http://newandroidbook.com/AIvI-M-RL1.pdf
[Google Pixel XL Questions & Answers] aholeinthewor1d:
There are a total of 5 bootloaders technically. There is the PBL which is stored in ROM. I'm guessing there is something unique in this which when connected with Google's serves to decide if the device can be unlocked or not.

Then each "slot" also has 2 bootloaders. Each has aboot and each has xbl.
[Google Pixel XL Questions & Answers] jjayzx:
There's a possibility you can't unlock again after a relock even if on 7.1, some people were permanently locked.
[Google Pixel XL Questions & Answers] LoliSmith:
I thought that was what jcase was implying. Do you know if the people on 7.1 who were permanently locked had done any flashing or received any updates at all before or after relocking?
[Google Pixel XL Questions & Answers] LoliSmith:
Thanks for that concise explanation, I tried to hit the thanks button but I did too many today I guess. Will do tomorrow.

What does PBL stand for?

What does xbl stand for?
[Google Pixel XL Questions & Answers] aholeinthewor1d:
PBL = primary boot loader

XBL = eXtensible boot loader. This replaces SBL (secondary boot loader) on newer processors

Edit: https://www.inforcecomputing.com/inforce-qualcomm-secure-boot-prevents-malicious-software
[Google Pixel XL Questions & Answers] LoliSmith:
Thanks again. So PBL is in the boot ROM and XBL executes prior to aboot loading?
[Google Pixel XL Questions & Answers] aholeinthewor1d:
Yea pbl>xbl>aboot
[Google Pixel XL Questions & Answers] LoliSmith:
In the firmware, there are the following images:

tz.img (trust zone?)

aboot.img (android bootloader)

xbl.img (extensible bootloader)

If both the Verizon and Google Pixels have the same tz.img, aboot.img and xbl.img, then the difference between the devices must be in PBL in the Boot ROM. And the factory must flash a different PBL to the Verizon devices than to the Google devices.
[Google Pixel XL Questions & Answers] aholeinthewor1d:
That was my thinking also. Just realized jcase said it connects to Google's servers to determine if it can be unlocked or not. Well how does it do that with no internet access? I've already taken a pixel out of the box and removed the SIM before powering on. Then during setup skipped connecting to wifi and then unlocked with dePixel8. So there obviously has to be something in the hardware which determines if it can be unlocked or not.
[Google Pixel XL Questions & Answers] LoliSmith:
I am on 7.1 Android security patch 10/5/16. Build NDE63N.

That is the original firmware, yes? I have a regular Pixel, not a Pixel XL.

If so, I should be able to relock and then unlock again. I can't remember if I had WiFi off when I first set up the device. I know I did not have an active SIM in the phone.
[Google Pixel XL Questions & Answers] LoliSmith:
This is pretty fantastic if true:

https://xdaforums.com/showpost.php?p=71561177&postcount=38
[Google Pixel XL Questions & Answers] aholeinthewor1d:
Yea I was going to mention the CID but figured you already found that info. At first it appeared that you could identity a Verizon vs Google pixel by the CID but then I've seen multiple people prove that theory wrong. A bunch of people got pixels from Google directly and their CID was the same has the Verizon one.
[Google Pixel XL Questions & Answers] bobby janow:
It's not. I have Project Fi and it's grayed out.
[Google Pixel XL Questions & Answers] aholeinthewor1d:
I'd be really interested to know what happened. His post seems pretty detailed implying that he tried to unlock multiple times with no luck but was successful after using the Project Fi SIM.

So you have a Verizon bought pixel currently activated on Project Fi?
[Google Pixel XL Questions & Answers] bobby janow:
Yes. Never activated on vzw but bought from them directly.

edit: I had it when I could depixel8 it but chose not to. I'm running locked bootloader on all my devices these days.
[Google Pixel XL Questions & Answers] LoliSmith:
Well it seems like his was brand new and had never had a Verizon SIM in it. I wonder if that makes a difference? He said he tried the OEM unlock command and then updated to the March firmware then activated with a Google Fi SIM.

Or maybe we are being trolled, lol!
[Google Pixel XL Questions & Answers] aholeinthewor1d:
I created a thread on Reddit asking people to try it out. One person said he has a Pixel on 7.1.1 activated on Verizon currently with a locked bootloader. His wife has Project Fi so he's going to try activating with her sim and then unlocking when she gets home from work.
[Google Pixel XL Questions & Answers] LoliSmith:
jcase mentioned "virgin" phone. That coupled with his claim that they connect to the google servers makes me think if this is true, you should not connect to the Verizon network before you put the Project Fi SIM in the device.

https://xdaforums.com/showpost.php?p=71561335&postcount=40
[Google Pixel XL Questions & Answers] aholeinthewor1d:
I think he mentioned trying a virgin phone just to be 100% there were no other variables coming into play when testing. At the same time it would be nice to have.someone test a new out of the box very Pixel on 7.1.1. Someone should create a test thread and make sure to mention to pull the SIM before booting and then skip connecting to wifi during setup.
[Google Pixel XL Questions & Answers] LoliSmith:
He said he never activated it with a Verizon SIM in it.

https://xdaforums.com/showpost.php?p=71562067&postcount=3

https://xdaforums.com/pixel/help/phone-verizon-7-1-1-unlockable-t3577438/post71562112#post71562112
[Google Pixel XL Questions & Answers] bobby janow:
I think we're barking up the wrong tree.
[Google Pixel XL Questions & Answers] LoliSmith:
Yeah, it seems like there are a few recent Verizon phones that are being shipped from the factory that haven't had the bootloader configured so that it is not unlockable. According to someone else on the Pixel forum, the OEM unlocking is grayed out even with the Google Pixels until they connect to the internet. So the SIM may not matter, these phones may have been unlockable no matter what SIM was in them initially.
[Google Pixel XL Questions & Answers] wtherrell:
If you jump off a cliff with no parachute or device you are most likely going to die. No I haven't actually successfully tried it and am not sure if it's a fact. I'm just speculating.
[Google Pixel XL Questions & Answers] LoliSmith:
On some XDA forums in the past people noticed things and then speculated what the implications of their observations might be. The speculation lead to exploits that enabled bootloader unlocking and root in some instances.
[Google Pixel XL Questions & Answers] Icanthelplt90:
So i just tried this with a new phone with 7.1.1 on it. booted it up with no sim to check if i could unlock and then threw a fi sim in it from a friend activated and rebooted to see if i could unlock. it didn't work, bootloader is still locked. I HATE Verizon for this lol like its my device let me unlock my ****
[Google Pixel XL Questions & Answers] LoliSmith:
Did you try checking for updates and taking an OTA?
[Google Pixel XL Questions & Answers] Icanthelplt90:
Yes, it got one update. I am trying to enroll in the beta program now and waiting for download and see if that works. I doubt it, but there's always hope right.
[Google Pixel XL Questions & Answers] bobby janow:
Remember when jcase said in order to find out what the trigger is we would need to reverse engineer the firmware? It can't be the sim. It's way deeper than that. He knows.

If it were that simple he'd know it and so would all of us. If there was a way to unlock it he would be the one to do it. There is no way other than to buy a Google phone unless you get lucky as some people have. Or unless Verizon changes the policy.
[Google Pixel XL Questions & Answers] LoliSmith:
Jcase's method has nothing to do with these 2 cases, they didn't use depixel8.

For this 2 cases, either the phone wasn't properly flashed at the factory or it is the SIM. Likely the former, but either way it has nothing to do with the exploits that have now been closed. These 2 phones are running 7.1.1 so they don't even have the exploits that depixel8 relied on to work.
[Google Pixel XL Questions & Answers] LoliSmith:
Thanks for the info. It is looking like the 2 people who got Verizon Pixels without the OEM unlocking being grayed out got phones that were not flashed properly at the factory.
[Google Pixel XL Questions & Answers] bobby janow:
What I asked him was, what determines whether or not the option is grayed out. That's when he said I'd need to reverse engineer the firmware. It wasn't about depixel8.
[Google Pixel XL Questions & Answers] LoliSmith:
That doesn't mean that there can't be a glitch that jcase is unaware of that allows unlocking by a different mechanism. He knows of one way, that doesn't mean there aren't other ways.
[Google Pixel XL Questions & Answers] bobby janow:
There is nothing jcase is unaware of when it comes to Android.
[Google Pixel XL Questions & Answers] TonikJDK:
This statement is not debatable. It is straight up fact.
[Google Pixel XL Questions & Answers] LoliSmith:
That's definitely an overstatement. There are unknown bugs in every piece of firmware and if someone doesn't take the time to try to find them, they remain unknown. AFAIK, jcase found the bugs in 7.1 bootloader and now has no interest in investigating any later versions of the firmware so he isn't looking for them any more. Or at least that is what he has stated publicly.

The 2 phones at issue here are on 7.1.1.