yashsingh1/xdaforums huggingface dataset:
[Google Pixel 2 Questions & Answers] blueyes:
There's actually the same cmd to get pxl2s unlock code. Only useful after it's unlocked, same as the HTC. I have a OG xl, bought a Verizon 2xl thinking it'll be hacked as quickly as the OG. Just sold it on eBay, turned around and bought a Google version and didn't lose a dime.

https://drive.google.com/file/d/1mE2IgQ8_Gc4HdyeJjHQDuLTtEZxHkJWf/view?usp=drivesdk

Printed up some of the cmds

---------- Post added at 03:13 PM ---------- Previous post was at 02:52 PM ----------

I think these guys could do it , if you read their posts. True hackers, borderline criminals. Lol

https://sinister.ly/Thread-Google-Pixel-2-XL-IMEIs-Verizon-GS
[Google Pixel 2 Questions & Answers] crixley:
**SCRATCH MY ORIGINAL RESPONSE, I TOOK A CLOSER LOOK WHILE I'M AT WORK**

I see what you mean, those are not commands however in the sense that we can enter them ourselves. We need to find a way to spoof the initial check that starts the provision, or use one of these ideas:

1.) fastboot oem get_identifier_token - this would be hard as it would require either breaking htcs method of creating unlock.bin files, or finding a way to sign them after tampering.

2.)fastboot oem readconfig/writeconfig. In order to use this we would need to figure out which bit is the "secure" bit. I believe writeconfig actually works on our device
[Google Pixel 2 Questions & Answers] mattie_49:
Can't believe it's been like this since March. Maybe the sunshine people will find a new way
[Google Pixel 2 Questions & Answers] crixley:
Feel free to help out. I've spent hours and hours on top of late nights at a busy engineering firm and two children. A lot of the exploits have been figured out by near luck. It takes a lot of time and effort, and unfortunately pixel devices are not as developer supported as nexus ones were.

The fact that we are even in this situation and that google even allows verizon to run the show is frustrating enough.
[Google Pixel 2 Questions & Answers] mattie_49:
I wish I knew where to even begin helping. I know quite a bit but my knowledge is all about after the bootloader is already unlocked. Sorry didn't mean for it to sound pushy. Didn't mean it like that. I have a new baby as well. Life comes first for sure
[Google Pixel 2 Questions & Answers] crixley:
I didn't mean to be rude either, you seem like a nice guy it is just that honestly it is the best way to get something done. I have been using android a long time and learned through practice and a ton of reading. Sometimes it is the only way you'll see any results.

I thought of something else as well as a possible solution:

Since our chips are qualcomm, we could try finding the firehose files for our device and use qloader/qpst to write directly to the partition, or even just as an easy method to provide folks on here to flash android version back to when lock_critical worked (some sort of a command line tool perhaps?)
[Google Pixel 2 Questions & Answers] blueyes:
I think a lot or most of the code needed to be patched is in the modem.img as he said.
[Google Pixel 2 XL Questions & Answers] Chouiyekh:
Since i updated to official android Pie, i notice the battery performance is changed, but unfortunately it's not changed to better but to worst! Is everybody has this problem? or just me?

Before the final version of Android Pie released, i tried all the beta versions but i didn't get the battery problem.
[Google Pixel 2 XL Questions & Answers] Superdad_98:
I had the same problem for about a week, but now it's as good as it was on 8.1 8% per sot hour, 0.3% per sleep hour
[Google Pixel 2 XL Questions & Answers] EeZeEpEe:
There's already a couple threads discussing battery with Android Pie:

https://xdaforums.com/pixel-2-xl/help/android-pie-pixel-2-xl-battery-life-t3827183

https://xdaforums.com/pixel-2-xl/how-to/battery-life-pie-heres-experience-hear-t3827873
[Google Pixel 2 XL Questions & Answers] Chouiyekh:
So we have to wait for the next update ! And wishing to fix that by google
[HTC Wings] stopfen:
Hello,

I am looking for a tool that can refuse a call (identified by number) and calls back immediatly.

Background: I have a flatrate, so I can callback some people that call me for free.
[HTC Wings] Litoven:
"Ignore send send" is too much?
[HTC Wings] stopfen:
Muuuch to much ;-)

When I could save this problem with a little tool/script, why not?

The computer should work for me.
[Honor Note 10 Themes, Apps, and Mods] MarkAndroid:
Good morning,

I could not find the setting for the dark mode and to make the wallpaper with the default launcher. Has this possibility been eliminated or can it be activated?

If it can be useful, the scrollable wallpaper option works with Nova Launcher by forcing the scrollable wallpaper from the Nova settings.

Inviato dal mio RVL-AL09 utilizzando Tapatalk
[Honor Note 10 Themes, Apps, and Mods] 7isok:
Default doesn't scroll for me and neither does Nova, not even with 'force' activated. I've tried all the launchers in the playstore and only Go Launcher scrolls on this phone. Are you sure Nova is scrolling?
[Honor Note 10 Themes, Apps, and Mods] MarkAndroid:
Yes whit Nova Launcher 5.5.4 (use force scroll)

Inviato dal mio RVL-AL09 utilizzando Tapatalk
[Off-topic] ajster1989:
So this seemed as good a place as any to post this and hope someone can help. One of my IT customers had a POS system that is running on an android operating system. He asked me if there was a way to get the restaurant management apps that are on his tablets (also android) to work on the android terminal so he can throw the extra tablets out. He has 1 tablet for Grub Hub, 1 for Uber Eats, and 1 for Door Dash. Door dash had their app in the play store, so that was easy to install. Grub Hub and Uber Eats doesn't put their restaurant manager apps in the play store (not to be confused with their ordering or delivery apps). I called them and their generic support team didn't know how to get the app and recommend just using the website.

Basically I'm hoping that there is some awesome android power user out there that also that might know how to get those APK's. I was going to try to root the tablets that were sent to my customer but both Grub Hub and Uber Eats has some kind of kiosk MDM software blocking everything.

Thanks!
[Off-topic] eurodiesel:
Whaa?

So, you are asking about how to get those apps (APKs) which are installed?

Can you install apps, say Mixplorer? You can copy apps using it.

Also, if you can enable usb debugging (if it doesn't show up then clear data of the Settings app) then root it with kingroot via pc but then you may get into trouble imho.
[Samsung Galaxy S7 Questions and Answers] edy.xda:
Dear Folks,

I have one European S7 SM-G930F. I am in UK and VoLTE is not working with Vodafone. I think it has to do something with the fact that I flashed the Indian ROM in this phone, as VoLTE was not working when I was in India. Now that I am back in UK, I want to enable VoLTE.

I have few questions, need help guys :confused: :

1) Can I do this without erasing data?

2) If I only flash the HOME_CSC will it work? Link:https://www.sammobile.com/firmwares/galaxy-s7/SM-G930F/VOD/download/G930FXXU2ERG2/229367/

Currently:

AP: G930FXXU2EREM

CP: G930FXXU2ERD6

CSC: G930FODD2ERE2

Cheeeers
[Samsung Galaxy S7 Questions and Answers] edy.xda:
:confused::confused::confused:
[Samsung Galaxy S7 Questions and Answers] Beanvee7:
If you flash home_csc it won't wipe and should give you the functionality.

Otherwise there is a flashable CSC tool that you use with TWRP, but I dont think it has Oreo support yet.
[Samsung Galaxy S7 Questions and Answers] edy.xda:
Back to Square one

Thanks, I ended up flashing TWRP, which resulted in boot-loop as I did not wiped the data partition and somehow TWRP messed up with my current installation. With boot loop in action and no option I flashed the Vodafone UK ROM, which was a German ROM ( I Don't know why SAM MOBILE would do this) like a spy in British Army. Anyways so all that did not enable VoLTE still and Samsung Pay stopped working. After googling turned out Vodafone UK is very specific to enable VoLTE only on their supplied handsets only. After wasting lot of time, I finally decided to go back to original ROM, now it will take at least a week to set it up with all my apps. What an epic waste of time mate ! Thanks for reading if yer did :P
[Samsung Galaxy S7 Questions and Answers] Beanvee7:
Yikes, I mentioned the TWRP method second, because it was an option, but it's not something you rush into. Always backup first, always read the full instructions.

TWRP trips Knox, which Samsung Pay uses, so you won't be able to use it again.
[Xiaomi Mi 5 Questions & Answers] chakkrit_pond:
Touch does not have to restart, restart 10 minutes to resume.

.. I'm not good at English
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
Any ideas how this could happen?

Update: Android attest key is lost when persist.sin partition is flashed.

Here is a screenshot of Service Menu -> Service tests -> Security soon after the XZ1c was bought. It reads:

Android Attest Key PROVISIONED

But now I have it like this (screenshot also attached):

Android Attest Key NOT PROVISIONED

Does it mean that my phone is no longer considered as unique and google play would consider it as a custom firmware not to be trusted or something like that?

Update: it can be used by a third party (for example play store) to check if your phone is still locked, without any chance to fake that due to use of cryptographic signatures and certificate chains in Trust Zone.

Please see post#98 for a "howto truly verify Android Attest Key working presence" including patched Auditor app that uses the key and following posts #99 till #102 showing various results including a trial to change something in a signed response, with conclusion in post#103:

Please note, I did not unlock the bootloader (as documented by a current screenshot too).

It does not help to do a full factory reset.

It does not help to flash full firmware, not even the version which the phone was bought with (tried even keeping all files including all .ta for flashing with newflasher).

Does it mean my XZ1c lost (something like a drm) key from "hardware-backed key storage"?

Some details about the use seems to be here https://source.android.com/security/keystore/attestation.

This would be quite unfortunate to lose some keys even without unlocking :(

Done only few sony stock fw flashing via newflasher (I have attached log of the first flashing done for downgrade and a log of the last one trying to restore original fw fully) and some testing of user space apps via adb as described in this thread.

As a final restore attempt I let a FOTA system upgrade to run, it upgraded to 12.34 version, did a factory reset after that, but the attest key is still not provisioned there.

Any ideas what went wrong?

Particularly opinion of [MENTION=4120742]munjeni[/MENTION] would be interesting to me as his newflasher was used and the logs are available.

Could it be caused by something in the early fw to which the phone was flashed to (even though .ta files were skipped when flashing it)?

Or some issue with flashing procedure? At the first attempt I tried the initial prompt to backup ta, not sure, if it was safe (also visible in the log).

Thanks.

-- edit, added on 2018-10-28 --

There might be a chance to recover the Android Attest Key from a phone (xz1 compact or xz1) which still runs 47.1.A.8.49 or older fw.

Is here anybody with such phone? Still locked? With the Android Attest Key still PROVISIONED?

It may be possible to recover it from TA partition backup.

Anybody with such phone, contact me please, if willing to help me to test that.

Thanks.

You will need to backup your phone before the test - it would involve a downgrade of fw.

More info here please:

[DEVONLY][XZ1c] exploits for temp root to backup drm keys development

-- edit end, strike added on 2018-11-18 --
[Sony Xperia XZ1 Compact Questions & Answers] xrenoix:
hello you have test flash reset .ta partition with flashtool ?
[Sony Xperia XZ1 Compact Questions & Answers] Didgesteve:
No, loosing your TA partition only effects your Sony software, like the stock camera and a few higher functions.

It won't effect your Play store.

You can 'fix' the phone to think that it has the DRM keys (on the TA partition) and everything works as normal. You can even root your phone and still use android pay.

Yes, you've broken a part of your phone and you'll never ever get that back, but you're part of XDA and we're here to help you and fix it.
[Sony Xperia XZ1 Compact Questions & Answers] albmanzi:
So what are the possible consequences of losing Android attest key provisioning? I'm interested because a method to backup the TA partition before unlocking bootloader might be coming soon, but it will require downgrading firmware and losing Attest key provision (read https://xdaforums.com/xperia-xz1-co...-exploits-temp-root-to-backup-t3795510/page20 )

Could it in any way cause the system to not pass SafetyNet?
[Sony Xperia XZ1 Compact Questions & Answers] Blu-eyes:
I've lost my attest key when debranded my xz1,

Safety net check pass, I'm able to use Android pay and Pokemon go, also ota update still work

Sent from Italy by my xz1
[Sony Xperia XZ1 Compact Questions & Answers] albmanzi:
I didn't realize the OP of this thread is the awesome developer of fw exploit trying to backup TA partition in the thread i linked. I'm totally going to donate to you j4nn, once the backup method is publicly released in detail. I'm just worried about this Attest key issue... I hope we all get an exhaustive answer!
[Sony Xperia XZ1 Compact Questions & Answers] Meloferz:
In my case, I'm using a Xperia XA2 with locked bootloader, and changed my firmware customization... I changed from US to GEL and what is different is that SOMC Fido key is not provisioned.
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
[MENTION=5853845]Meloferz[/MENTION], that is very surprising.

Just wondering, what does GEL customization stand for?

Could it be that for GEL region FIDO feature is not supported?

Maybe if you flash back to US the key might re-appear (if it was just disabled for GEL)?
[Sony Xperia XZ1 Compact Questions & Answers] Meloferz:
The GEL customization is for my region (Latin America), and is the first customization to get updates and with not US bloatware.

Maybe is not supported in my customization because we don't use contact less payments (at least in Paraguay, maybe in other countries of latam too I think?).

Didn't checked before I flashed the GEL customization, and didn't know on that time about FIDO, and others authentications
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
As updated the first post:

It would be great if there is anybody with a still locked XZ1c running 47.1.A.8.49 fw or any older and still having the Android Attest key in "provisioned" state. That is your either did not accept any OTA updates on purpose or you just bought the phone (and that fw version is pre-installed) - watch out not to accept any update in that case please.

Anybody please?
[Sony Xperia XZ1 Compact Questions & Answers] pbarrette:
Hi [MENTION=4418980]j4nn[/MENTION],

From what I can tell, the

/vendor/bin/secd

binary is making calls to QSEECOM via the tzxflattest TrustZone applet in order to determine the key provisioning status.

Additionally, it's looking in the

/persist/data/keymaster64

directory for something. My keys are gone from my BL unlock, so I don't know what's supposed to be in there.

It's also getting the persist.keyprovd.attest.prov property to determine if it's set to true.

I haven't yet found where that property is getting set.
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
Hi [MENTION=4782500]pbarrette[/MENTION], can you differentiate if that concerns Android Attest Key or just the two SOMC keys?

I've also looked into that secd, but I am not sure.

Anyway, it may be possible that at least those two SOMC keys are not erased from Trust Zone with unlock.

Instead it could be that they are just disabled with 'unlocked' flag, secd ignoring them, even though they may be available with restored device master key in TA.

This is something I would like to test currently with [MENTION=5677791]tramtrist[/MENTION].

With Android Attest key it might be different as it is not connected to unlock.
[Sony Xperia XZ1 Compact Questions & Answers] pbarrette:
Looking closer, the Android Attest key is looked up in the devsec_get_debugmenu_report() function.

The call looks like this:

LODWORD(reference_Var) = 1
int_AndroidAttestKey_Result = devsec_get_key_prov_status(3LL, &reference_Var);
android_PushString((__int64)&string_Stream, (__int64)" Android Attest Key", 20LL);
if ( !int_AndroidAttestKey_Result )
{
if ( (_DWORD)reference_Var )
{
str_ProvisionedText = "\tNOT PROVISIONED\n";
int_Result = 17LL;
}
else
{
str_ProvisionedText = "\tPROVISIONED\n";
int_Result = 13LL;
}
android_PushString((__int64)&string_Stream, (__int64)str_ProvisionedText, int_Result);
}

So it's calling the devsec_get_key_prov_status() function with param1=3 and param2=refVar.

That status function looks like this (condensed to the appropriate parts):

devsec_get_key_prov_status(__int64 result, _DWORD *a2)
v2 = a2;
case 3:
intptr_DirStream = opendir("/persist/data/keymaster64");
if ( intptr_DirStream )
{
int_LoopCounter = 0;
while ( 1 )
{
intptr_DirEntry = readdir(intptr_DirStream);
if ( !intptr_DirEntry )
break;
v28 = intptr_DirEntry + 19;
if ( (unsigned int)strcmp(intptr_DirEntry + 19, ".") && (unsigned int)strcmp(v28, "..") )
++int_LoopCounter;
}
result = closedir(intptr_DirStream);
if ( int_LoopCounter >= 5 )
goto LABEL_22;
}
else
{
v29 = "vendor/semc/system/core/libasb/security_daemon/backend/device_security/get_key_prov_status.cpp";
v30 = __strrchr_chk("vendor/semc/system/core/libasb/security_daemon/backend/device_security/get_key_prov_status.cpp", 47LL, 95LL);
if ( v30 )
{
v30 = __strrchr_chk("vendor/semc/system/core/libasb/security_daemon/backend/device_security/get_key_prov_status.cpp", 47LL, 95LL);
v29 = (const char *)(v30 + 1);
}
v31 = (unsigned int *)__errno(v30);
v32 = strerror(*v31);
result = androidLog2((__int64)"secd", 1, (__int64)v29, 0x4Fu, "failed to open %s dir, error %s", v33, v34, v35, v36, v37, v38, v39, v40, "/persist/data/keymaster64", v32);
}
break;
LABEL_22:
v15 = 0;
*v2 = 0;
goto LABEL_27;
LABEL_27:
result = v15;
return result;

The devsec_get_key_prov_status() function also handles cases 1 and 2, which do a property_get on persist.keyprovd.attest.prov (SOMC Attest Key) and persist.keyprovd.fido.prov (SOMC FIDO Key).

So the android attestation key report is related to having at least 5 files in

/persist/data/keymaster64/

.

I just tested that by creating a

keymaster64

directory, creating 5x 0-byte files in that directory named 1, 2, 3, 4, and 5.

Now, if I go to the debug menu, it shows "Android Attest Key: PROVISIONED".

Obviously, that's not a very robust check for the debug menu to be making, so there must be files placed there by some other process and those files probably have some valid purpose.
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
That /persist mount looks interesting.

But not sure if the content is not generated somehow from TrustZone.

There are following directories in case of my xz1c:

/persist/data/tzattest/
/persist/data/fidocrypto/
/persist/data/wv/

The last one probably concerns widevine.

I am missing the /persist/data/keymaster64/ directory.

But if valid content from that directory would suffice to make the attest key available and usable, that would be another reason to try to retrieve those files from 47.1.A.8.49 fw or older via exploit.
[Sony Xperia XZ1 Compact Questions & Answers] HandyMenny:
With the help of Notepad++ and 7zip I searched for "attestation" and "keymaster64" in the firmware of my xz1 (downloaded with xperifirm).

There are reference to keymaster64 and key attestation inside keymaster_X_BOOT_MSM8998_LA1_1_O_82.mbn.

Looking better, probably this file contains the code that compares osVersion and osPatchLevel from tee with the osVersion and osPatchLevel from system image and read or write /persist/data/rsa_attest_key and /persist/data/ecc_attest_key

In system I found this file: https://gist.github.com/HandyMenny/a623cdcaf89c0aee7b3a91ed12c8dc4a

Here is another reference to key attestation: https://android.googlesource.com/pl.../master/keymaster/3.0/IKeymasterDevice.hal#42 and googling I found this log: https://pastebin.com/cRyYEtf2

Hoping to be helpful :)
[Sony Xperia XZ1 Compact Questions & Answers] notaz:
Can you check how it's mounted (/proc/mounts)? Is it a proper flash partition, not tmpfs or something like that?

I suppose anyone downgrading a virgin device should try avoiding to flash persist_*.sin (this .sin is small so probably just an empty fs), maybe the missing files are just placed there in the factory?
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
It is a proper flash it seems:

G8441:/data/local/tmp # mount | grep persist
/dev/block/sda33 on /persist type ext4 (rw,seclabel,nosuid,nodev,noatime,data=ordered)

G8441:/data/local/tmp # mount | grep ' /data'
/dev/block/sda66 on /data type ext4 (rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered)
G8441:/data/local/tmp # mount | grep ' /cache'
/dev/block/sda53 on /cache type ext4 (rw,seclabel,nosuid,nodev,noatime,discard,data=ordered)

But if it is part of fw package, would not it be flashed also with upgrade? Erasing /persist in all full firmware flash attempts?

That might rather indicate that the content may be generated if not yet existent (possibly from TZ).

Maybe we can check if it gets created new (aka binary different) with factory reset.
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
[MENTION=4782500]pbarrette[/MENTION], that think with keymaster64 dir containing 5 empty files is nice, works on my locked xz1c too.

Nice find, still, definitely that would not make the key do what it should do. The question is if the android attest key is tied to device or not. But with this test we won't find out. Any idea for a better test?
[Sony Xperia XZ1 Compact Questions & Answers] Blu-eyes:
If can be useful I have created an virtual image of from a Xperia companion firmware..., With all partition that can be mounted, but I don't remember what was in persists partion

You can do this by writing the partion file inside partion zip to a 64 gb image(created with truncate ) then this image can be mounted with losetup (Whit 4k sector size from kernel 4.18+)..

Then I restored every partition extracted from Sim to the virtual partion...

(PS. I know that you are aware of these command,but If you need to know what's inside a file use file and binwalk)

Sent from Italy by my xz1
[Sony Xperia XZ1 Compact Questions & Answers] pbarrette:
I think this is all tied to Android Verified Boot.

The bootloader is apparently validating hashes in the cryptographically signed

/dev/block/platform/soc/1da4000.ufshc/by-name/vbmeta

(or

/dev/block/sda57

) partition.

I haven't had enough time to read through all the documentation. Most of it talks about using the vbmeta partition for rollback protection. The idea being that the bootloader can prevent boot completion if a rollback is detected. But I'm wondering if the vbmeta partition can be used for rollback detection and subsequent invalidation of the device attestation state, because Sony obviously isn't preventing rollback, or stopping the boot process.

Here's the main document from google.

Honestly, I'm not sure how important the SOMC FIDO/Attest and Android Attest keys are.

Google Pay seems to work. Fingerprint logins seem to work. Etc.
[Sony Xperia XZ1 Compact Questions & Answers] j4nn:
I have no idea about keybox.xml and xperia devices.

Afaik attestation key is device specific and if persist partition is flashed, the key is lost forever.

You could transfer key files from a different phone, possibly service security menu could show it then as provisioned, but it would not work with any attestation attempts, like with the Auditor test discussed in this thread - read the first post and follow the links there.
[Sony Xperia XZ1 Compact Questions & Answers] chiteroman:
No, that's impossible.