[G4 General] steadfasterX:
List of known Anti Rollback versions

List of known Anti Rollback versions

What is

Anti-Rollback

?

A way to ensure you can not go back to a ROM which is known to be vulnerable (e.g. where u could establish root).

Each vendor and carrier can decide if he implement this and patronize us dense users or if he thinks we can handle that on our own...

so if your carrier has implemented it he knows whats best for you (lol). Maybe he will tell us what to buy and eat as well some day?

Technical details:

anti-rollback for devices using qcom hardware: https://www.google.de/patents/US20140130151

which is a reference for: https://www.google.de/patents/US8745612 which seems to be the Android implement the qcom stuff

Enforcement:

If you flash a lower Anti-Rollback the device goes into EDL/EDL 9008 mode which requires to use either:

- the sdcard unbrick (flashing a valid image on a sdcard)

- using QFIL (dangerous - scroll down and read the EVIL firehose topic!!)

- or a box (requires hardware) to recover from the 9008 mode

How to identify the Anti-Rollback of a KDZ before flashing?

https://xdaforums.com/showpost.php?p=73950915&postcount=109

Howto check Anti-Rollback?

The following is confirmed to work on

MM

:

1. Open the phone app

2. In the dial-pad, enter the following code: *#LGMENU#*<model># (LGMENU resolves to 546368)

Examples:

H812: *#546368#*812#*

H815: *#546368#*815#*

This code may differ on your model and firmware

ATT and TMO users may use this instead: *#*#244773825625#*#*

LS991 users should try this: 5689#*991# or *#5689#*991#

3. Click SVC Menu

4. Click Version Info

5. At the very bottom, you should see the Anti-rollback value

H810

H810 A/B (NOT H810PR!!) = v0 (report)

H810-PR A = v1 (report)

H810 E/G = v1 (report)

H810 10o = v2 (report)

H810 21y = v3 (report)

H811

H811 10h = v1 (report)

H811 10n = v2 (report1) (report2)

H811 20i = v2 (report)

H811 20o = v3 (report)

H812

It seems any H812 firmware is v0 (not 100% known though)

H812 20o = v0 (report)

H812 20x = v0 (report)

H812 20z = v0 (report)

H815

It seems any H815 firmware is v0 (not 100% known though - but as of now: 100% for H815 international/EUR)

H815-EUR 20*any = v0 (well known)

H815-TR 20i = v0 (report)

H815-SEA 10c = v0 (report)

H815-P 20B = v0 (report)

H818

It seems any H818 firmware is v0 (not 100% known though)

H818N 10d = v0

H818-CHINA 10b = v0

H818P 10e = v0 (report)

H819

It seems any H819 firmware is v0 (not 100% known though)

H819 10b = v0

LS991

LS991 ZV4 = v0 (report) and (report)

LS991 ZV5 = v1 (report)

LS991 ZV6 = v2 (report)

LS991 ZV9 = v2

LS991 ZVA = v2

LS991 ZVB = v3 (report)

LS991 ZVF = v4 (report)

VS986

VS986 11A = v1 (report)

VS986 13B = v2

US991

US991 10C & 10D = v1 (report)

US991 20A & 21A = v2 (report)

F500

F500L Nougat = v0 (report) <-- may be irrelevant as the user seems to converted a nonfusing device to f500

--------------------------------------------------------------------------

PoC - Extractions

the extracted certificate chains of sbl1, aboot and boot:

H811: View attachment 4270323

H815: View attachment 4270324

LS991: View attachment 4270399

here the extracted

cerficate chains

of the firehose programmers (qfil):

Known to NOT blow eFUSE:

firehose with md5 hash: 7db5c4ef68ff36570e87a3ae5809224d --> View attachment 4270371

KNOWN TO BLOW eFUSE / EVIL FIREHOSE:

(if the above programmer does not work this one may still work but it will blow fuses)

Once you have used this one here u cannot use the other one anymore!

This firehose is blowing a fuse taken the device to userdebug! So you cant use the "normal" firehose anymore and may not be able to flash usual KDZs anymore.

firehose with md5 hash: d6123fd88abbf5173c76fc515bca3f04 --> View attachment 4270350

You see in the issuing cert that there is a slightly different

SW_ID

while all other fields (except the CN ofc) are kept the same. Maybe thats the reason for fusing here?

sfX