yashsingh1/xdaforums huggingface dataset:
[Google Pixel XL Guides, News, & Discussion] 5thspecialforces:
I am very sure I included where they could pick up the tools to get started they even have videos included and software pre loaded on the distros. However there are more people that read this than just those who post and, there are people that will look further than just throwing a dollar amount up. At no point did I claim to have a push button answer but there are tools as I said that are made and some that are even open source to deal with this very situation many of which come preloaded with SIFT.

https://github.com/sans-dfir/sift-bootstrap since you seem angry you can start there. We use a commercial software it's been a while for me with sift but I am sure they still include a PDF for Android response and I think even links to online videos maybe not what you're used to.

No need to be angry I have this phone saw it and posted. I mainly am here to check stuff out because there are alot of talented devs here and very creative stuff. So if you choose to wait that's on you, it can be done.

Oh I think you mean you need this step by step wrote out. I mean sure I can do that, give me a couple days and I don't want a bounty, I didn't make any of the stuff but I'll write it out if it needs step by step. As I said previously I am in aware of the "Bounty whatever" should be free anyways.
[Google Pixel XL Guides, News, & Discussion] pcriz:
What is hilarious is the mindset that you come in implying you're the only one smart enough to Google something. Thanks for the chuckle man, don't know about you but actual real life laughing is the opposite of angry.

Thanks for helping these folks out lol. Pass go, collect your prize. ;)

Man those guys that discovered the first exploit must be kicking themselves now knowing the answer was a Google search away.
[Google Pixel XL Guides, News, & Discussion] 5thspecialforces:
I think just one Google search is kind of trying to stretch it there. Especially typing in the search you would have ran, security updates are continuos because people are always figuring something not all of it surfaces and the zero day guys here (are they really here?). Zero day is pretty good I gave them their props as I edited I can type up some of the ways it can be done for you. Cause unlock bootloader search is very bad. Sorry my English I try.
[Google Pixel XL Guides, News, & Discussion] cam30era:
Bottom line: There's more than $1000 on the table, here, if you can successfully unlock the VZW version of the Pixel XL bootloader. Why don't you give it a try?
[Google Pixel XL Guides, News, & Discussion] awakenedwithin:
Then give the devs said forensic tools to bypass it.
[Google Pixel XL Guides, News, & Discussion] scvjohnny:
Sad how that 5thspecialforces guy gives us junior members a bad name. :)
[Google Pixel XL Guides, News, & Discussion] dpalmer76:
Time will tell! Let's wait and see.
[Google Pixel XL Guides, News, & Discussion] Hell-Razor:
Yeah. The hackers and crackers just need a little bit more motivation - sadly enough.
[Google Pixel XL Guides, News, & Discussion] pcriz:
I don't think it's a matter of motivation. It's probably a great deal know how and a sprinkle of chance. I think the people with the know how are as motivated as they need to be considering this isn't exactly a paid job for the majority of them.
[Google Pixel XL Guides, News, & Discussion] Hell-Razor:
That's what I meant. The bounty needs to get up there to make it a paid job. Not trying to complain, just ready to sit back and wait.
[Google Pixel XL Guides, News, & Discussion] Mash1996:
I'm in for $100
[Google Pixel XL Guides, News, & Discussion] fiffan86:
If the person gets temp root and unlocks the bootloader, they get 2k (if everyone follows through.....)
[Google Pixel XL Guides, News, & Discussion] bobby janow:
Do you really think at this stage there is any interest by a dev? You want unlock then by a Google version. Same device, same cost. Especially if you're donating 100 to make it the same as a Google device.

If you need to unlock the bootloader sell your VZW device and take your hundred dollars loss, save your bounty, and call Google for free delivery.
[Google Pixel XL Guides, News, & Discussion] NepoRood:
I agree with this, there are plenty of people that don't care about root or custom ROMs. I would have sold mine on Swappa or eBay (and took a $100-200 loss) had I not been able to return it to the store. We're coming up on Q4, and there will be some great new phones coming out...
[Google Pixel XL Guides, News, & Discussion] Hell-Razor:
My Pixel started acting funny. Just got a new one at the store and they are now being shipped with 7.1.1. DAMN!
[Google Pixel XL Guides, News, & Discussion] bobby janow:
What do you mean it started acting "funny"? What does this have to do with the temp root bounty in the OP?
[Google Pixel XL Guides, News, & Discussion] dpalmer76:
Probably saying he hopes someone comes up with something!
[Google Pixel XL Guides, News, & Discussion] bobby janow:
Yeah perhaps. I do feel badly for those that want bl unlock and will never get it on the vzw device. Maybe everyone will learn to read the fine print for the Pixel 2 so we won't need these threads in the future.
[Google Pixel XL Guides, News, & Discussion] pcriz:
Trust me, they won't. You have people still trying to use the old bootloader exploit.
[Google Pixel XL Guides, News, & Discussion] bobby janow:
You're probably right. Live in hope... If Verizon once again locks the bl for the 2 I'm not sure what I'll do. I'll buy one on black Friday again I guess if Google doesn't offer the same deal. I've had a locked bl since I got this and I'm not really caring much.
[Google Pixel XL Guides, News, & Discussion] Hell-Razor:
Yeah lets just live in hope somebody is bored enough... lol
[Google Pixel XL Guides, News, & Discussion] bobby janow:
Won't matter. Not gonna happen.
[Google Pixel XL Guides, News, & Discussion] jackzhu:
Remove me from the list. I have been back to unlocked edition.
[Google Pixel XL Guides, News, & Discussion] bill.in.detroitX:
[MENTION=2477527]mrjaydee82[/MENTION] - I'll offer $50 to add to the list. Let me know when it happens and I will post the $.

I love the Pixel XL but hate the way Verizon treats it's customers (like f'n children).
[Google Pixel XL Guides, News, & Discussion] spleenandcigars:
count me in for 10usd
[Google Pixel XL Guides, News, & Discussion] wpearson:
Has anyone considered the option of using a published vulnerability post Dec 5? Can we assume that if people are interested that they aren't taking OTA security updates until/if this is resolved?
[Google Pixel XL Guides, News, & Discussion] SquaredDev:
Count me in for $125 and $50 to charity of the releaser's choice. Would love to be able to pay more but that is all the wife says I am allowed to pledge.
[Google Pixel XL Guides, News, & Discussion] cam30era:
[MENTION=2477527]mrjaydee82[/MENTION],

I'm selling my XL on swappa. Please remove my contribution commitment. And best of luck...
[Google Pixel XL Guides, News, & Discussion] Mike02z:
I'm afraid this will never happen. You can easily get the XL direct from Google and it's easily unlockable. Many of us VZ owners got the bootloader unlocked prior to 7.1. Everyone knows that starting with 7.1 you could no longer unlock your boatloader. I feel bad for the folks who had an unlocked VZ and had it replaced with an XL with 7.1. If you bought new once 7.1 came out. I have no sympathy.

I will say when the Pixel 2 comes out. I'm buying direct from Google. Screw Verizon.

There is a very limited user base that bought Verizon Pixel XL's with 7.1 that want to be unlocked. Not saying it can't be done. I'm saying it won't be done. I don't think Beans or jcase are even trying at this point and I don't blame them.

My advice, run stock or sell it on Swappa and buy direct from Google. I know many bought this on the 2 year no interest offer from VZ. You'll need to pay that off before selling.
[Google Pixel XL Guides, News, & Discussion] fiffan86:
I got TMO to pay my off ;) I've been stuck since I got my insurance replacement in may, then switched in june. I'm content now for the first time in 7 years lol
[Google Pixel XL Guides, News, & Discussion] jakegub:
I'll add $50 if this is still going.
[Google Pixel XL Guides, News, & Discussion] zengfu94:
Looks like S8+ just got root thru an exploit. Maybe it'll work on the Pixels.
[Google Pixel XL Guides, News, & Discussion] Hell-Razor:
Would be nice
[Google Pixel XL Guides, News, & Discussion] :
I already disassembled the Linux kernel from the Android 7.1.2 (NJH47F) factory image to take a look in the kernel to see if temp root is possible - however I wonder about dm_verity key in the file img_info and I know it may pose a bit of a challenge in making the root work since dm_verity kernel has size hash on the suffix (which I may try by booting the recompiled kernel from fastboot, but not flashing it as it's risky). I may look around the system image and kernel a bit more to see if it is feasible.

*** EDITED*** I found that bootloader lockdown is handled by a software inside bootlocker.img found in the factory image zip - if we can exploit this, we can unlock the phone's bootloader. I did some digging in GHEX hex editor on this image file - let's see if you can find some keys that we can abuse, as I can't afford IDA disassembler (if I can afford it, I would have found the exploit by now - its pricing sounds like a rip-off but that's another story).
[Google Pixel XL Guides, News, & Discussion] Icanthelplt90:
Does the Free version or trial not get you what you need in IDA?
[Google Pixel XL Guides, News, & Discussion] keithman2567:
I have $20 towards the bounty.
[Google Pixel XL Guides, News, & Discussion] :
Nope, trial version is limited to older PowerPC derivatives and x86. That's it. I almost got the heart attack seeing how much the 64-bit ARM disassembly license cost - almost three grands.
[Google Pixel XL Guides, News, & Discussion] Seanz13:
Are you saying you could possibly get us the temp root?
[Google Pixel XL Guides, News, & Discussion] scvjohnny:
$3k, that's crazy!
[Google Pixel XL Guides, News, & Discussion] con4n007:
Probably but at a cost of $3000. Even the bounty total value is only about 1k ish
[Google Pixel XL Guides, News, & Discussion] Seanz13:
Does anyone know of any programs that Dr. Mario could use that is free. I really need this temp root!!!
[Google Pixel XL Guides, News, & Discussion] soateufel:
Jeez, 3 grand? what exactly would you need that amount for?
[Google Pixel XL Guides, News, & Discussion] ThexMasterr:
I'm not a developer.. and have no experience using disasssmbly software. There are some free alternatives to IDA pro though. Radare2 for instance. Not sure what kind of capabilities you would need to pull something like this off.
[Google Pixel XL Guides, News, & Discussion] :
I will look at it. My only concern is how the machine code is treated; while generic GCC compilation of the Android OSes are still common, some companies like Google prefer to use Krait performance compilation option (or other options relevant to CPUs like Mediatek SOCs for instance) in GCC compiler so they get a bit better performance. (And yes, you can still use Krait compilation option, even in the 64-bit mode, as Kryo CPU in Snapdragon 82x SOCs is in fact a modified Krait core with ARM64 mode added to it - somewhat like Pentium 4 is to recent Core ix series Skylake (which uses recently-revived infamous Netburst architecture, now faster, cooler and leaner) - I didn't forget the ill-fated Pentium 5 Prescott which ran too hot either...)

Long story short, I don't want to be thrown off by the CPU performance optimization which tend to obfuscate some machine codes a bit when I decompile some vital BIOS firmware add-ons finding out how to unlock the whole thing.

EDITED: No mentioning of ARM64 decompiling capability.... I will either give it a try or wait a bit, or find a different decompiler.
[Google Pixel XL Guides, News, & Discussion] ThexMasterr:
Are those kind of issues still present when using professional software like IDA pro? It's a bummer there is such a massive pay-wall between us and a potential unlock exploit, so I was just trying to help. I don't claim to know anything about this stuff, but I wish you good luck in your hunting for an exploit!
[Google Pixel XL Guides, News, & Discussion] :
As much as I want to blow my foot off with a shotgun, I suspected there's a good reason why there's huge paywall behind IDA Pro; it's to keep the tool out of wrong hands.

And on the topic, radare2 failed to disassemble the bootlocker, just like I suspected. No ARM64 disassembly support (to make matters worse, Google blocked radare2 from Google Play - I already have Verizon ASUS Z10 which is a 64-bit tablet and will also benefit from unlocked bootloader too - sometimes big screen makes it better for me to scan through the machine codes)... It's frustrating sometimes. Oh well, I will have to look for the different disassembler.

EDITED: Giving Capstone a try. Fingers crossed...
[Google Pixel XL Guides, News, & Discussion] :
Little process with Capstone - I will get back on it - there's steep learning curve associated with this line-command disassembler...

So, I decided to "steal" the bug report of the entire OS in my Google Pixel and boy, Verizon variant is VERY weird. It explicitly allows OEM unlocking through separate kernel user land - dmesg snippets in the first TXT visible in root of bugreport ZIP said two different things; ro.oem_unlock_supported=1 while androidboot.oem_unlock_support=0 - it's still possible to unlock the bootloader despite the conflicts I have seen in the bug report (which I pulled out of both boredom and mild frustration), just a bit more work for me.... I will have to figure out how the Qualcomm Snapdragon secure bootloader handle the bootloader lock variables handed to it in the extracted last_kmsg file.
[Google Pixel XL Guides, News, & Discussion] zengfu94:
I have IDA Pro. pm for telegram
[Google Pixel XL Guides, News, & Discussion] :
Thanks for the offer - first off, I want to ask, do you have ARM64 license? I just want to be sure, and I also can do TeamViewer if so necessary. Just had to let you know upfront that I am deaf, so I am not sure if Telegram would help much but, you know. I just want the whole work on bootlocker.img - the complete work - so I can be sure there's nothing missing, that way I can figure out what makes it tick then I can try and create the exploit.

And, on the other side note, bootloader locker in both last Nougat and Oreo has barely changed. I will pull bug report again once my Verizon Pixel got Android Oreo installed so I will see if there's any changes in BIOS "datapath" up to final stage of Linux boot procedure.
[Google Pixel XL Guides, News, & Discussion] aholeinthewor1d:
All we need is temp root and someone already said they'd package up a tool to unlock the bootloader then
[Google Pixel XL Guides, News, & Discussion] joderme:
I'm willing to bet [MENTION=2376614]jcase[/MENTION] has at least 5 unlock methods for the VZW Pixel... Hopefully you guys can get the temp root.
[Google Pixel XL Guides, News, & Discussion] jcase:
nope.
[Google Pixel XL Guides, News, & Discussion] :
The only reason jcase says nope is because the Android ecosystem is a lot more volatile nowadays. Thankfully the bootloader locker agent have barely changed, leaving us a potential opening once we find out what makes it tick. As for temp root, I am not sure how the bootloader would react as it mandates the modified boot.img nowadays - anything else will not work. :/

*** Any modifications we make to the Linux kernel nullifies OTA certificate as well as encryption-generated verification keys which the bootloader use to make sure it's the blessed kernel it can safely boot - it's difficult to keep the OTA certificate key into modified kernel as any changes in file size invalidates it, resulting in bootloop. I don't know what voodoo Samsung hackers use, unfortunately our bootloaders' second stage BIOS is profoundly different from what Samsung have on Galaxy S7 and beyond, not to mention Google have habit of shooting down the rooters.
[Google Pixel XL Guides, News, & Discussion] pcriz:
This is a real life example of why you shouldn't meet your heroes lol.

Jk
[Google Pixel XL Guides, News, & Discussion] :
Temp root is kind of tricky, but I feel a bit tempted to try. However, I need to figure out how to manually root the whole thing, and I can't extract a thing from update-binary as I need to know where to put su binary and busybox - whatever I need to stuff them into Linux kernel, in order to gain root.

*** By temp root from within a modified Linux kernel, I mean to do tethered fastboot boot - I can't flash anything onto the phone as it can and could result in brick, or switching into Slot B which may also introduce some bugs that weren't there. Booting the Linux kernel via fastboot boot command is probably a safer option, until we gain the bootloader unlock. ***
[Google Pixel XL Guides, News, & Discussion] LaosPerson:
Holy moly, the bounty continues? Slightly off topic, but since my pixel XL Verizon is bootloader unlocked (I'm an early adopter can), I should be able to do anything with it even though I install the regular updates right? Even though my pixel is non modified, I found no reason to modify it yet, which I kind of feel guilty because most of you in here would kill for an unlocked bootloader, and here I am letting its potential rot away.
[Google Pixel XL Guides, News, & Discussion] :
The bootloader lock variable is stored in FRP directory - hence we need root to abuse it, and this directory of course survive the update, whether stock or custom ROM is used.

As for the Pixels with the bootloader already unlocked, the recent update (Verizon's Android Oreo update for instance) will not change the bootloader lock variable (as Google already know, it usually result in brick, so it's better to toggle OEM unlock variable before bootloader lock can be safely done, it's how the bootloaders work nowadays). Thus, you don't have to worry about it, except for potentially irritating bootloader unlock warning screen upon rebooting.
[Google Pixel XL Guides, News, & Discussion] :
Ok, I have tried tethered booting of modified, unrooted kernel (with ADB secure disabled) as a test, no dice - it just tell me to unlock the phone before I can attempt that. Google have really beefed up the security on the bootloader. Looks like we will need to rely on some type of XIP (Execute in place) root exploits which have been used in several Motorola and HTC phones before but it will be difficult this time - not impossible but harder.
[Google Pixel XL Guides, News, & Discussion] TonikJDK:
You are fine, no update will relock it. At this point you should just consider your phone a Google phone. The only thing you should not do is ever slide that slider back to locked. No one has tried that I know of but it could be bad for you.
[Google Pixel XL Guides, News, & Discussion] cowsquad:
**** verizon
[Google Pixel XL Guides, News, & Discussion] :
Or better yet, install a custom ROM that has the OEM Unlocking slider disabled and permanently set to unlocked. That way it's hard to brick it by accident.

On the other hand, I won't be surprised if someone have successfully sued Verizon over the bootloader locking practice as it's a direct violation of Magnum-Moss act (aka rights to repair act), not to mention the current LTE usage agreement.
[Google Pixel XL Guides, News, & Discussion] LaosPerson:
Well, on stock rom, it's grayed out but says bootloader already unlocked, I'm glad unlocking it was the first thing I did when I got it (in my mind I wanted to future proof it when updates are stopped) and compared to the Samsung phones I've been getting, no defects so I haven't had to exchange my pixel.
[Google Pixel XL Guides, News, & Discussion] :
Excellent. Good move in unlocking the bootloader in the place.
[Google Pixel XL Guides, News, & Discussion] :
I guess I can just donate some money - I will decide at some point (probably $10 or 20) as exploitation isn't my strongest forte - even though I can analyze how the system work. Oh well. (I even talked to Verizon about allowing me to obtain bootloader unlock officially after having paid off the phone in full - only for them to tell me to screw myself.)
[Google Pixel XL Guides, News, & Discussion] EstiR86:
This seems like something they would say
[Google Pixel XL Guides, News, & Discussion] :
Decided to cover my base, disassembled a few APKs (and a few more in meanwhile), it was a lot of work - however OEM Unlock toggle is more of a virtual toggle value, so I will have to find out whose is to blame for greying it out and force it to enable - hopefully without having to root the phone.

And, reading the XML is kind of tiresome - there's a LOT of them in the system settings APK.
[Google Pixel XL Guides, News, & Discussion] EstiR86:
I have a Google pixel from the at store and it is bootloader unlocked but I have Verizon as a carrier so when I put my Verizon sim in it downloads Verizon apps and I also believe it downloads some verizon system apps such as Verizon oma trigger, vzw msdc api, and a few others can these be reasonable for greying out oem unlocking. Also I'm not familiar how SIM cards works but how is it possible for the sim to install system level to the device and can this exploited.
[Google Pixel XL Guides, News, & Discussion] :
Those bastards, at least I now can narrow my scope. I already disassembled the systemui.apk file, and OEM Unlocking strings are housed therein. Thanks for giving me a rope. I also hope root comes quickly enough to beat me at that game.

*** I think it may be either VzwOmaTrigger or VzwLcSilent app. It is not going to be trivial shutting down those sh*twares without root, but I am sure bootloader unlocking ability is not 100% removed even on Verizon Pixels, just they made it harder for us to do so.
[Google Pixel XL Guides, News, & Discussion] death2all110:
[MENTION=6207927]blueyes[/MENTION] and I were discussing this in a thread a while back. We found that /data/system/users/0.xml may be the controlling factor here. However, I believe root would still be needed. So probably not any help.

You can see the full discussion here. https://xdaforums.com/pixel-xl/how-to/verizon-pixel-xl-toggling-oem-unlock-t3498287
[Google Pixel XL Guides, News, & Discussion] :
I guess Verizon was very impatient and poked their you-know-what into the apple pie. In this case the 0.xml which I wasn't able to read without using some kind of CMD privilege escalation, which Verizon got to it before me.
[Google Pixel XL Guides, News, & Discussion] EstiR86:
Yup it always seemed odd to me why system apps were instilled when I put my sim in but I put two and two together and thought maybe this could be a cause to our problems. Hopefully something can be done about it !
[Google Pixel XL Guides, News, & Discussion] TonikJDK:
So if this therory is correct you would be able to unlock a new Verizon phone if you fired it up without a VZ SIM.

I don't believe that is the case.

And wouldn't my Google phone have locked when I got it and started it up with a VZ SIM? It didn't.
[Google Pixel XL Guides, News, & Discussion] EstiR86:
I don't think it's that simple but I think we are on the right track when you try to unlock the bootloader with the sim during first set up it makes you have a connection to the internet and I believe what we need to do is figure out what information it is sending when this is happening and how to modify it without root.

Edit: to your second question like I said during first boot when you connect to WiFi something is being sent to Google telling it it's okay to unlock the bootloader on this device but if someone with a vz pixel boots first time it sends a different message to Google saying this isn't okay to unlock. I believe it is the vzw meid that is causing problems and I don't know any way to chance the device id.