yashsingh1/xdaforums huggingface dataset:
[Google Pixel 2 XL Guides, News, & Discussion] jhutchins:
I don't have a pixel 2 xl, I'm assuming by the existence of this thread that they have modified aboot to not allow unlocking or flashing. but if they left LAF partition intact then it shouldn't take long to get a solution going.

So in my opinion you definately need to flash the aosp aboot image to get a proper fastboot mode but the question is, are there other partitions that need to be overwritten (maybe SBL SBL2 or something) which need to be flashed too? Did verizon change just aboot or is the secondary bootloader also different. You should be able to dump these partitions and compare them with the ones you download from google. I'm also assuming that the stock google version and verizon version are identical when it comes to hardware but i have no idea.

Here is they script i made (google drive id) 1EQ75dBlRCPkB25Rv4Ky9TlfQD5cGbTpE (from modifying github Lekensteyn/lglaf ) to perform a bootloader downgrade attack on my nexus 5x without unlocking the bootloader. Again, written for 5x, ive never had a pixel, use it as a starting point, maybe not a finished working solution.

Alternatively (and probably better option), have you guys tried flashing direct with OpenPST tools?

I havent tried it but it looks like they have code for interacting with both the chipset and laf.

Sorry, I can't post any actual links.
[Google Pixel 2 XL Guides, News, & Discussion] MColbath:
The problem with OpenPST is that we don't have the programmers and sahara xml. As for why there isn't any progress with LAF we can't write to the device. We are able to dump partitions, and we can execute the write command but nothing actually changes when the write command finishes. There are probably a few other issues as well.
[Google Pixel 2 XL Guides, News, & Discussion] jhutchins:
Weird. Are you opening in write mode?

You know only /dev/block/mmcblk0 can be opened in write mode and to do it you just use OPEN with no arguments or payload, u can't directly write to specific partition, u write to the memory as a whole and just specify the offset.

If your already doing that and it not working then it probably hasnt successfully done the kilometr unlock handshake crap. But if that were the case id think you would be getting an error rather than it just not changing anything. if you've tried both the known keys listed in lglaf.py then there must be a new unlock key in which case someone will need to provide a copy of the p2's laf to extract it from (maybe someone with the non-verizon variant can?)

---------- Post added at 07:53 PM ---------- Previous post was at 07:37 PM ----------

Also, have u checked if LGUP supports your device? Might be easier since all you want to do is flash some partitions to a less restricted version.

Also, what do you mean by programmer? I thought that all these new Qualcomm chipsets communicated over USB. Im not sure how to expose that interface though other than bricking the device.
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
So I'm sure this is a very stupid question, so no need to be mean if it is. I've been out of the rooting scene for a while, as I haven't rooted a phone since my htc 10. But would the bootloader become unlockable if we were to sideload the official Google OTA here: https://developer.android.com/preview/download-ota

Or would that brick a Verizon device/not affect the boot partition? Just a shot in the dark here, lol.
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
It would do nothing as the VZ software and the Google software are exactly the same.
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
Again not to sound stupid. But if the VZW software and the Google software are the same, why is "Enable OEM unlock" clickable with Google devices and greyed out with Verizon devices?
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
They are all locked when they ship. When it is first started up, or after a factory reset, it phones home to Google for permission to unlock. If it is a Google phone the slider is allowed. We are sure of that part.

We don't know for sure, but most of us believe it is based on IMEI number.

Someone that used the Facebook guy to unlock the OG Pixel said they saw him copy the IMEI as he was unlocking the phone. So he found a way to replace the number with an unlockable one...then put the original back. Or he found a way to spoof Google's servers to give the unlock command. I vote he found a way to change the IMEI.

Again, that last paragraph is what I believe.
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
Ok that makes sense. I believed I've messed around with IMEI before, but I'm not sure I'm ready to drive back into that. And I won't even push that any farther on here as to avoid discussing breaking the law.

However, this could be an instance where two wrongs make a right, haha. Considering Verizon has been breaking the law since 4G came out (in many ways, bootloader locking included). Just so sick of big red, but I couldn't pass up the deal I got.
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
Yes, the packets are in this thread, or one of the OG Verizon unlock threads.

Spoofing the Google server may be hard. I would imagine the phone is looking for a connection that is backed by a Google cert.
[Google Pixel 2 XL Guides, News, & Discussion] runningnak3d:
I will search for the packet dumps .. thanks!

I wasn't talking about writing a whole replacement for the Google servers, just injecting a valid IMEI that will get them to send whatever data unlocks the device. Now, if I were writing the server for Google, I would tie the unlock data to the IMEI, so that it would only work with the IMEI being sent. However, some people on here are pretty convinced that it can be done, so maybe that is a hole Google didn't think about.

-- Brian
[Google Pixel 2 XL Guides, News, & Discussion] ProjectAlly:
This is my most watched XDA thread period.

Selling my VZW variant on Swappa now, but until it does sell, I'm F5'ing hoping to see it unlocked.

Verizon are just ridiculous and I'm an idiot who got scammed thinking he was getting the Google version of the phone...oh well there goes that investment.

I have faith it can be unlocked, just a matter of time, glad to see all the ideas/brainstorming. It's actually encouraging. :)
[Google Pixel 2 XL Guides, News, & Discussion] GokuSSJgod:
How much did you list it for. There's a bunch on there for cheap.
[Google Pixel 2 XL Guides, News, & Discussion] joedeuce:
[MENTION=3167089]runningnak3d[/MENTION] or anyone else, any idea what the 0x80000118 error represents? I get it when I run IOCT so I assume it means either the command isn't there, or something isn't getting passed to it. I've been idling in the IRC channel for some time, but there isn't anything happening there.

Also, shouldn't we be able to write the dumped partitions back to the device? Reason being I zeroed out the persist partition and I haven't been able to write it. As someone said, it says it's writing it, but nothing happens. Luckily I do have a dump so it may be salvageable.
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
Hopefully something along this route will lead us to a solution! I wish I could help more but am quite limited on my abilities compared to most people here. I can however confirm that sideloading the Android P Developer Preview does not work. Even booting with no sim.

I'm liking P, but I'm still anxious to get that bootloader unlocked!

---------- Post added at 03:45 AM ---------- Previous post was at 03:17 AM ----------

Just wanted to add an additional thought here, and I don't know if it's been tried yet. But could something as simple as putting in a Google fi sim work? Possibly with a factory reset required? Only thinking that it would boot and reach Google as a fi device (which are unlockable). Or are we (illegally) carrier locked as well?
[Google Pixel 2 XL Guides, News, & Discussion] jhutchins:
well that sucks. I never encountered actual RSA signing in the LAF before but i was working with devices manufactured during marshmallow that had been upgraded to nougat or Oreo which would have left the old laf on, hence my perceiving the signing to be simple to defeat hard-coded symmetric authentication/signing. Can someone post a copy of the laf partition so we can try to find a buff overflow or something in the new version (I don't have an lg anymore but i like the challenge and so would love to poke around with the binary a bit)? I don't see many other option unless yall want to start tearing apart your phones and applying random voltages to random test points (still more likely to succeed than attacking RSA directly).

On the other hand, ehhem.... corporate d***head, if you're listening... blink twice if you left a backdoor and then started a phone rooting service on the side.

---------- Post added at 08:51 AM ---------- Previous post was at 08:12 AM ----------

Also, #2 is irrelevant because...screw lafd. If i get to where i am able to overwrite the laf partition, I will simply read the stock one from the device, modify its ramdisk boot parameters to load adb instead on boot, and then flash that partition back and then just use adb from that point on. All that is required is a write primitive at which point we can make the modified laf.img load whatever communication service we want and make lafd sit quietly in jail next to all the verizon execs.
[Google Pixel 2 XL Guides, News, & Discussion] joedeuce:
At work now, but I can give you a link to 2xl laf when I get home.
[Google Pixel 2 XL Guides, News, & Discussion] runningnak3d:
[MENTION=836059]joedeuce[/MENTION] IOCT has been pulled for a while now. As the name would imply, it was used for issuing ioctl() calls to the block devices. That has been replaced with the payload sent in OPEN.

On old eMMC devices, if you needed to set a device R/W:

OPEN

IOCT fd_num,0x1261

Also, yes, 0x80000118 means command / opcode not found.

-- Brian
[Google Pixel 2 XL Guides, News, & Discussion] joedeuce:
Thanks. I used h872-miscwrte branch as a starting point... You think your python is bad - wait til you see mine ? (and as an aside, I find your code very readable). I see now that dev-h932 sends a payload with OPEN. I'm sure people have tried using that payload on the 2xl. You got it from sniffing a legitimate upgrade on the h932 I assume?

Too bad we don't have any legitimate traffic to lafd for our device, I guess with that we could at least figure out the payload to send OPEN so that we could write partitions, or more specifically rewrite erased ones dumped from the 2xl.

I think the forbidden 4 letter abbreviation that starts with an "I" and ends with an "I" may be stored in persist (along with mac addresses, etc), so hopefully no one does anything stupid like I did and erase that partition.
[Google Pixel 2 XL Guides, News, & Discussion] JerichoAbles:
I hate to waste thread space, but with this information you guys collected, how close do you think you are to even starting a root method?
[Google Pixel 2 XL Guides, News, & Discussion] GokuSSJgod:
Lol
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
That's it, I think I'm gonna sign up for project fi, factory reset, activate on fi, unlock bootloader/root, and switch back... Well worth the $20 for one month of fi. Unless of course someone who knows answers my question about if we're carrier locked or not. Cause I dunno how to tell.
[Google Pixel 2 XL Guides, News, & Discussion] joedeuce:
Disregard... I see that the SIGN payload contains a list of the partitions.
[Google Pixel 2 XL Guides, News, & Discussion] runningnak3d:
You get different partitions with that payload because the the first 14 bytes are the block device that you want to open. That payload opens /dev/block/sde

If you change the 14th byte to hex a or b or c ... etc, you will get those block devices instead. The rest of the flags can remain the same.

-- Brian
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
What in the world makes you think a different SIM will unlock your phone?
[Google Pixel 2 XL Guides, News, & Discussion] lucky_strike33:
Report back if it works but I doubt it.
[Google Pixel 2 XL Guides, News, & Discussion] Strephon Alkhalikoi:
It won't. The bootloader will remain locked regardless of which SIM is inserted.
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
My thinking is that with the phone activated on fi and freshly wiped, it will activate on Google's network, Google will recognize the IMEI as a device on its network, and at that point allow me to check the OEM unlock option. Verizon will not be involved at all and therefore will not prevent this option. I know it's a long shot, but from what I can tell no one has tried it. All pixels have the same hardware regardless of carrier, and since pixels purchased from Google on fi are unlockable, I see no reason why a pixel that is moved to the fi network (especially running the p preview) shouldn't be unlockable. Maybe this time an unlock solution is the simple one that no one is bothering to try cause it's just too simple. Either way, I'm gonna give it a shot and post my result.
[Google Pixel 2 XL Guides, News, & Discussion] joedeuce:
It's more than a Longshot... It's a waste of 20 bucks IMHO. ?
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
So if you are so certain this won't work, perhaps you can explain why, instead of basically mocking the idea? I've explained why I think it might work, giving a basis for my argument. So please tell me, if OEM unlock is determined by carrier/IMEI, why exactly this wouldn't work? Especially since Google allows it on phones on their Network, and typically in the past if "unlocked" phones were locked somehow, all one would need to do is contact Google and request that it be unlocked. So please, some details on your negative/unsupportive comments would be much appreciated. Thank you.
[Google Pixel 2 XL Guides, News, & Discussion] GokuSSJgod:
Go ahead and try. Have fun resetting up your phone.
[Google Pixel 2 XL Guides, News, & Discussion] joedeuce:
Maybe because I tried it. ?
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
Go back just a couple pages, see my post on how the unlock process works. Verizon has nothing to do with, it's all via Google and it won't matter what Network or SIM you are on.

People are being short with you because this theory comes up rather often. It has been tested, asked and answered quite a few times. So folks tire of the repeated clutter.
[Google Pixel 2 XL Guides, News, & Discussion] micmars:
Indeed.

I'm unclear what's more fragile in here, the irksome thought-expiriment-from-pre-K being rightly mocked, or the excited about we-didn't-try-THAT-hammer cheering squad.

Honestly, if someone's able to get this done, they'll do it in silence and expect payment. Someone smart enough to figure this out ain't telling you.

Sent from my Pixel 2 XL

#WhiteUIsMustDie, #EndDarkAppOppression
[Google Pixel 2 XL Guides, News, & Discussion] Spinkness:
Wow...

What a douche...

I remember the days when XDA was a place where all could contribute. A place where trolls like you were rightly removed by the mods.

We all want the same thing here, and all I ask for is civility. And again, as I've stated several times yet, it seems no one is paying attention, all I did is suggest a simple try at something, based completely on the words of those who now mock me. And I did go back a few pages and look at the genius post of knowing exactly how it works, only to point out now that that very post was a response to me. Not only that, but it was the post that I based my whole suggestion on.

I have stated myself that I don't know as much as most of the people on here. And yet you pat yourselves on the back for mocking me. It's like (since you insist I'm Pre-K), having a child ask you a bunch of questions that you refuse to answer, as you then proceed to mock and ridicule them for not knowing the answer to the questions they just asked you.

Please just go back to Facebook, where trolling belongs.

Good day sir.
[Google Pixel 2 XL Guides, News, & Discussion] micmars:
It's not xda-whiners.

What you describe never existed.

Users learned, understood the value of common decency and fealty to learning was paramount.

This is xda-developers, which means you check your ego and feelings at the URL.

You think I'm trolling you?

I'm giving you the unalloyed truth.

Meritless ideas are marginalized, not given participation trophies.

You want to simultaneously play the victim and scratch out the eyes of those calling your ideas insignificant.

That is what feral children do.

You're welcome.

Sent from my Pixel 2 XL

#WhiteUIsMustDie, #EndDarkAppOppression
[Google Pixel 2 XL Guides, News, & Discussion] btwinme:
But isn't the problem that we have a Verizon variant and not that we use other network providers, for example I'm using TMobile.?
[Google Pixel 2 XL Guides, News, & Discussion] elliwigy:
can you unlock yours on tmobile? lol i doubt it if its a vzw variant
[Google Pixel 2 XL Guides, News, & Discussion] mrkhigh:
Bootloader lock and carrier lock are very different things.

You're also looking at gsm vs cdma most phones are designed for one and not the other, often the phone is even built slightly different. (Antenna)

This thread is root for bootloader unlock or bootloader unlock for root.
[Google Pixel 2 XL Guides, News, & Discussion] micmars:
Indeed; the VZW Pixels are carrier unlocked, and will work on TMO and most networks worldwide.

A VZW Pixel 2 XL with a TMO SIM would be a carrier unlocked Taimen with a locked bootloader.

Sent from my Pixel 2 XL

#WhiteUIsMustDie, #EndDarkAppOppression
[Google Pixel 2 XL Guides, News, & Discussion] hector689:
Late reply to late post
[Google Pixel 2 XL Guides, News, & Discussion] MColbath:
So, is there a reason to hold back on updating the phone anymore?
[Google Pixel 2 XL Guides, News, & Discussion] misc6207:
I was thinking the same thing. I may give up on this whole idea.
[Google Pixel 2 XL Guides, News, & Discussion] Badger50:
If it were me, and it's not, I would just update the device and wait it out. I mean if a functional exploit is found, more than likely it won't matter what build your on. Then again, a solution may never be found anyways. So why wait?? But that's just my opinion :cool:
[Google Pixel 2 XL Guides, News, & Discussion] slogar25:
Yeah. I was staying idle on the February update waiting for an exploit. But decided to get into the DP2 beta. It is not going to matter. I'm thinking most everyone looking in this thread has already moved on. I mean we are approaching June.
[Google Pixel 2 XL Guides, News, & Discussion] MColbath:
Considering the options left, I guess I'll go back to looking at the EDL. That being said, anybody know if these are applicable for the device?

http://bits-please.blogspot.com/2015/08/exploring-qualcomms-trustzone.html?

https://googleprojectzero.blogspot.com/2017/07/trust-issues-exploiting-trustzone-tees.html
[Google Pixel 2 XL Guides, News, & Discussion] nelsonTituaAa:
I gave up hope.. hadn't updated my pixel since Nov.. I installed the P beta.. for what I need.. I just found modded versions of IG, and YouTube.. I'll never make this mistake again when getting the pixel 3..
[Google Pixel 2 XL Guides, News, & Discussion] ArkhamKnight:
At this point, better off waiting for the Pixel 3 ? wonder if any other carriers will have access to it.
[Google Pixel 2 XL Guides, News, & Discussion] Inerent:
??? What do you think about this?

https://xdaforums.com/crossdevice-dev/sony/windows-10-arm-uefi-development-sd-835-t3791643

1. Win 10 ARM can be installed in QEMU virtual machine

https://winaero.com/blog/install-windows-10-arm-qemu/

2. QEMU is available for android

https://github.com/subho007/qemu-and...master/INSTALL

3. Can someone install QEMU then Windows 10 ARM then boot win10 from QEMU and see if it has acces to the storage?

My bet is that from there we can make a full backup, bit by bit of all partitions, regarding that the data will be encrypted, it does not afect us. It can be restored later encrypted as it was.

Don't know if it will be possible to flash the bootloader in your case, but for our Sony's xzp we need just to make a full system backup. Maybe you have some luck and win10 arm can operate on the storage and be able to change the bootloader
[Google Pixel 2 XL Guides, News, & Discussion] Strephon Alkhalikoi:
The gentleman who replied to you in that other thread is correct. The bootloader is encrypted. Until the bootloader is either decrypted or a bug or back door is found in the bootloader which bypasses the encryption, there will be no write access to the file system.
[Google Pixel 2 XL Guides, News, & Discussion] Inerent:
Who says that Windows 10 arm needs to be installed in the file system partition?

Do we know for sure that win10arm isn't capable of accessing ufs storage if it gets installed in sdcard? No, we don't know that. What I know is from Windows we can make bit by bit backup of the entire storage, we don't need to see or acces partitions for that. They will be restored automatically later.

The only thing needed here is that windows has driver for emmc and ufs which it needs to have since it was released on sd 835 platform.

P. S. Also loosing android but being able to replace it with win 10 arm is a thing that I will do it in second 2. Just got sick of google s android os

i know that I m pleading my case and in pixel case it May be possible to never get bootloader replaced /unlocked, but, hey, if you could do a full phone backup it s worthing
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
To expand on the above you won't unlock until you can write. You can't write unless you have root, or you can impersonate Google. You won't crack the encryption, you need temp root.
[Google Pixel 2 XL Guides, News, & Discussion] MColbath:
I'm not sure if this needed or even useful but it looks someone partially dumped the device on github.

https://github.com/TadiT7/google_taimen_dump?files=1
[Google Pixel 2 XL Guides, News, & Discussion] Strephon Alkhalikoi:
Because it bears mentioning, the amount of time required to brute force the encryption is longer than the current age of the universe. So to get through the encryption an exploit is mandatory. One silly question though: wouldn't it be Verizon that would have the decryption key rather than Google?
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
No, all of this is Google. It is the same software as the Google version, exactly. Made by Google and maintained by Google. Verizon never touches it.
[Google Pixel 2 XL Guides, News, & Discussion] Strephon Alkhalikoi:
My understanding was Verizon got their grubby mitts on the firmware beforehand. I must be confusing this device with all the others. ?
[Google Pixel 2 XL Guides, News, & Discussion] TonikJDK:
Yea, the whole system for the OG Pixels and the 2's is unique.
[Google Pixel 2 XL Guides, News, & Discussion] MColbath:
You know, I really have to give it too google at this point for making such a secure bootloader. I mean, you have to admit it's impressive that they more or less covered every method that could be used to exploit. At this point I am just hoping for some kind soul to upload the signed programmers and sahara files for the QDL or someone to reverse engineer those files. Although, I really doubt somebody will upload it, reverse engineering might be possible considering that the non-verizon bootloaders can be unlocked.
[Google Pixel 2 XL Guides, News, & Discussion] GokuSSJgod:
LG V30 has been unlocked maybe that'll help

https://xdaforums.com/showpost.php?p=76584629&postcount=193
[Google Pixel 2 XL Guides, News, & Discussion] Addiso:
Its a abl bug which is triggered with cross flashing a kdz. Afaik this handset does not flash through LG UP.
[Google Pixel 2 XL Guides, News, & Discussion] GokuSSJgod:
Ok was worth a shot
[Google Pixel 2 XL Guides, News, & Discussion] Travisdroidx2:
Wow, you guys are still trying ha. I will give it to you for hanging onto the hope.
[Google Pixel 2 XL Guides, News, & Discussion] ceelos218:
I sense a smartass sarcastic remark.