yashsingh1/xdaforums huggingface dataset:
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Now, that I have locked bootloader on my Oneplus 5, and made sure that everything is working including encryption, I have disabled OEM unlock within developer settings. When I put the phone in fastboot and try 'fastboot oem unlock', I get a response 'FAILED (remote: Flashing Unlock is not allowed'. Since the bootloader is locked, no one can put another self-signed recovery or kernel via fastboot or otherwise, as it can only be done with unlocked bootloader. They can start the phone and get to my recovery, but data cannot be mounted and adb sideload wouldn't work either. They can try to press cancel at password prompt, but TWRP can't format unmounted data. The only way to proceed is to flash stock recovery via adb or full stock. In any event, my data is wiped.
[OnePlus 5 Guides, News, & Discussion] obol2:
Will this work if the phone is decrypted (using no verity)?
[OnePlus 5 Guides, News, & Discussion] vdbhb59:
But in any case, the OEM unlock from dev option can be turned on, and then surely one can get through, right?

Also, did you go bootloader locked post encrypting, I mean is this the last step?

For my guidance, can you tell me, the sequence (number wise please), how to go encrypted?

Btw, any snapshot of bootloader failure?
[OnePlus 5 Guides, News, & Discussion] vdbhb59:
I dont think, cause it is encrypted.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Guys. Read 9-10 in the OP. Everything about encryption is there.
[OnePlus 5 Guides, News, & Discussion] vdbhb59:
Oops, my bad. I get your point. :)

Will try over the weekend. BTW, are you going for a release in the next 2-3 days? Then, I will clean flash once that is out. :)
[OnePlus 5 Guides, News, & Discussion] optimumpro:
I will update the rom once October security patches become available.
[OnePlus 5 Guides, News, & Discussion] david19au:
Thanks for the guide, I will try this when a new open beta comes out.

This might be really useful for those who have upgraded their devices from Widevine L3 to L1 by OnePlus, only to be disappointed that after unlocking the bootloader, L1 breaks.

One question tho, although right now I'm encrypted, I do not have that dialogue "To start Android, enter your password" with a black background when booting. Normally when I reboot, I get to my lockscreen with my wallpaper etc. and when I try to unlock the device, there's a small scrolling text saying "Unlock your device to access your apps..." or something around those lines. This seems like a bit different encryption than the one I have. Any clue on why's that? (fyi, I am 100% encrypted, TWRP asks me for my password to decrypt data)
[OnePlus 5 Guides, News, & Discussion] optimumpro:
That's because you are encrypted with FBE. My rom has FDE, and it is not forced. So, if you are force-encrypted, you need to flash 'no verity', as stated in the guide. You must be de-crypted to relock. Then, if you want to be encrypted, reflash your rom without 'no verity'.
[OnePlus 5 Guides, News, & Discussion] david19au:
Ohh, I see. Thanks for the swift answer!

I have two more questions: if I want to update my recovery, I need to keep the generated keys and with those keys I need to sign the recovery.img again, right? And do you have any guides on generating the keys while on Windows? Or do I have to be on Linux to generate the keys using those commands?
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Every time another recovery or kernel are installed, you need to sign. Only kernel could be signed on the phone. Your keys are supposed to be on your PC.

Haven't been using Windows for 10 years. So, can't help you.
[OnePlus 5 Guides, News, & Discussion] david19au:
I have a Linux VM just in case this happens :D but maybe you should mention it in your thread as most users here use Windows.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Additional experience having a custom rom on locked bootloader:

It appears that nothing, not even stock kernel or recovery, could be flashed via fastboot, if 'oem unlock allowed' is unchecked in Developer's settings. I tried to flash stock recovery via fastboot and got a response: 'remote flashing is not allowed', and fastboot is remote flashing. So, the only access to the phone is TWRP and unless data is mounted (via entering password/pin), not much could be done there either.
[OnePlus 5 Guides, News, & Discussion] vdbhb59:
So, the only way around is by OEM unlock checked? This is good. Fully encrypted and hope it does work, especially for me. I will do a clean flash tomorrow. Can you share in the other thread just for me the exact steps for going Encrypted?

Once more please..
[OnePlus 5 Guides, News, & Discussion] optimumpro:
So, were you able to encrypt on Jaguar?

Regarding locking bootloader: just remember, you have to be de-crypted when re-locking. Otherwise, encryption key will be automatically erased, and you will have to do everything from start.
[OnePlus 5 Guides, News, & Discussion] vdbhb59:
Ohh, so in that case a bit confused. If I Encrypt Jaguar, then locking bootloader will be done how? Sorry if it is a stupid question.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Whatever rom you have, if you are encrypted (whether FDE or FBE), you must wipe encryption by doing factory reset in TWRP before re-locking. Otherwise, when you re-lock, your encryption key will be wiped, but encryption will stay, so, the phone will be useless. You can do encryption later, when you are successfully re-locked.
[OnePlus 5 Guides, News, & Discussion] Chiku7:
no OEM unlock option in Developer setting

In case i want to unlock bootloader after sometime how i can unlock boot loader.? there is no "oem unlock" switch in custom ROM? please post link any tutorial if available.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
deleted
[OnePlus 5 Guides, News, & Discussion] arvindgr:
Thanks a lot for the guide! [MENTION=5075064]optimumpro[/MENTION] Does it mean once I have DRM Widewine L1 enabled in my phone, installing custom ROM and locking the phone, will still have L1 enabled?
[OnePlus 5 Guides, News, & Discussion] david19au:
Nope, L1 still won't work even when this is performed. I had high hopes but was quickly disappointed after trying it. You have to be complete stock to have L1 working.
[OnePlus 5 Guides, News, & Discussion] praveenkv1988:
Considering the LineageOS public key is available now, Can we use that in the recovery(for flashing official lineageOS builds) and lock the bootloader?

LineageOS public key: https://github.com/LineageOS/update_verifier/blob/master/lineageos_pubkey
[OnePlus 5 Guides, News, & Discussion] gee one:
I think that's the public key and not the private key.

It's used to verify that the private key that was used to sign the image is correct. If your recovery has that public key as part of the allowed keys, the official zips or anything that is signed with the private key will pass signature verification.
[OnePlus 5 Guides, News, & Discussion] praveenkv1988:
Yes, I think official recovery from LineageOS will allow images signed with LineageOS private key.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
First, you can never sign anything without the private key. Second, that public key is to verify that their rom update comes from them, as opposed to someone else. Their public key has nothing to do with recovery and/or kernel, but rather with the rom itself.

For the purposes of locking bootloader, it is irrelevant what Lineage's recovery can allow. You need recovery and boot image (not rom) signed to lock. And I am pretty sure Lineage's recovery/kernel are NOT signed.
[OnePlus 5 Guides, News, & Discussion] PokemonTotalWar:
I would like to do this, but I have two questions: What is the build.prop edit to enable/disable the OEM Unlock option in custom ROMs, and does this cause any issues when switching Firmware versions?
[OnePlus 5 Guides, News, & Discussion] turbotorsten:
[MENTION=5075064]optimumpro[/MENTION] If I follow this procedure and if I DON'T install Magisk afterwards, will my phone behave like full stock?

My plan was using this to only have TWRP just in case, to do backups and restore them.

So I have TWRP installed, but otherwise full stock, no root and bootloader locked. Will this fix safetynet issues(Google Pay, etc.) or will it still trigger safetynet since the phone isn't full stock?
[OnePlus 5 Guides, News, & Discussion] optimumpro:
At this point, Safetynet doesn't care whether your bootloader is locked or not. So, it doesn't matter, as long as you stay on stock and don't root.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
For anyone interested in re-locking bootloader on any custom rom and having absolutely no warning messages (such as 'your phone has loaded a custom OS), contact me via PM. You can have a custom rom with locked bootloader and zero warnings, just like on OEM rom.
[OnePlus 5 Guides, News, & Discussion] mysterio619:
I want to unlock my bootloader just to install gcam libfix..... I'm on 9.0.6 version......Will this guide work for me?
[OnePlus 5 Guides, News, & Discussion] strongst:
? This guide is for locking the bootloader on custom roms. You have OxygenOS stock rom and you need this guide https://xdaforums.com/oneplus-5/how-to/oneplus-5-unlock-bootloader-flash-twrp-t3624877
[OnePlus 5 Guides, News, & Discussion] koltun:
Good guide!

I've used it for OnePlus 3. Some notes:

- 9.0.3 firmware

- Official TWRP 3.3.1.0

- LOS 16.0 with "Enable OEM unlock and bootable image signing" changeset from March 28

- used AOSP verity keys

End result: secure phone with locked bootloader, encrypted storage TWRP recovery, running LOS 16 with no warning messages at boot.
[OnePlus 5 Guides, News, & Discussion] ADRez:
Is it possible to relock bootloader with stock Oxygen OS and have no bootloader warning messages?
[OnePlus 5 Guides, News, & Discussion] strongst:
Yes, like described here: https://xdaforums.com/oneplus-5t/ho...k-bootloader-flash-twrp-t3704592/post79512430
[OnePlus 5 Guides, News, & Discussion] ADRez:
I don't want to return to stock, I'd like to keep twrp, magisk and bootloader locked without warnings
[OnePlus 5 Guides, News, & Discussion] xda_wall:
I followed the instructions and everything worked. So I decided to encrypt the phone. I left it do it's thing and when I returned I got "Your device is corrupt. It can't be trusted and will not boot."

I can't get into recovery and in fastboot flashing fails with "flashing is not allowed in Lock State"

Any help with this?

edit: I followed this guide and started fresh.
[OnePlus 5 Guides, News, & Discussion] mysterio619:
Can I relock with custom kernel, TWRP and modified system partition of stock rom with this guide? ?

Also want to know how it affects the OTA updates
[OnePlus 5 Guides, News, & Discussion] strongst:
What should be the benefit from that?
[OnePlus 5 Guides, News, & Discussion] mysterio619:
Maybe using TWRP on locked bootloader to modify system partition? ..... Like installing gcam fix libs and ....take advantage of custom kernel performance... Maybe I am wrong...... Just asking if it is possible
[OnePlus 5 Guides, News, & Discussion] strongst:
I meant: what should be the benefit to lock in the bootloader? And not doing it on an unlocked bootloader?

You cannot take ota updates at all if you have a modified system regardless of bootloader status.
[OnePlus 5 Guides, News, & Discussion] ADRez:
The benefits of locking bootloader are on the OP
[OnePlus 5 Guides, News, & Discussion] optimumpro:
If you are on stock, you have verity protection for system, which means the phone won't boot with system modified. So, to use system modification on stock with locked bootloader, you must install Magisk, which disables verity.
[OnePlus 5 Guides, News, & Discussion] strongst:
Yes, i know
[OnePlus 5 Guides, News, & Discussion] optimumpro:
With locked bootloader and custom rom, the only vulnerability is access to TWRP. An attacker can potentially modify your system partition, but it would show up on your boot warning screen. To completely remove this vulnerability, this is what you can do.

Keep a TWRP app that can install recovery on a live device + your original TWRP on internal SD card. Then use that app to install either stock recovery or even better - a bogus recovery.img. This way, your phone won't boot into recovery at all. When you need to use real TWRP, install it with the TWRP app. When done, re-install bogus recovery.

This way, if an attacker gets your phone, he can't modify your partitions.
[OnePlus 5 Guides, News, & Discussion] schiavone.dimitri.2:
Hi everyone, I successfully got this set up on my OnePlus 3. I would like to know if I can compile my own twrp to allow flashing only images signed by me. Also I did read somewhere on Reddit that it is possible to build the whole rom embedding gapps and then enabling also dm-verity for checking tampering with /system and/or /vendor and other partitions. Any hints on how to do that?

Lastly I would like to know why people are signing their OnePlus 3/3T with OnePlus AOSP keys. I mean if the keys OnePlus uses are publicly available that means that a malicious attacker already has a mean to sign a custom boot.img and flash it on your device even with locked bootloader.

Inviato dal mio ONEPLUS A3003 utilizzando Tapatalk
[OnePlus 5 Guides, News, & Discussion] gee one:
I don't have this phone specifically, but I think most of those things are possible on other phones. dm-verity is now android verified boot on newer phones. It does much of the same things, one of which is hash verification of the images. This means that you have to install everything at build time, otherwise the hash will change and the images will need to be re-signed.

Some phones will allow you to sign with your own keys and relock the bootloader. You'll get the yellow warning and it should show you the key fingerprint for tamper detection. Changing the key could make it not boot and/or not decrypt.

Lastly, there is a place in twrp to change the allowed OTA keys. I think they are in res/keys or someplace like that. You can also secure adb and add your own adb_keys so that you can't even connect through adb without the right key.

All this security cubes at a price- you have to build everything into the rom. No flashing magisk or gapps. It all has to be built into the rom from the start. You also have to figure out how to apply firmware updates. Either through flashing in recovery, or backing up, unlocking the bootloader, updating, then re-locking again. This could be a monthly process.

Also, the chances are higher that you'll lock yourself out. You are closing a lot of doors on the phone, so there are fewer ways to get in and more ways to make a mistake.

---------- Post added at 02:58 PM ---------- Previous post was at 02:45 PM ----------

Here are some places to look:

https://android.googlesource.com/platform/external/avb/+/master/README.md

https://source.android.com/security/verifiedboot/avb

https://grapheneos.org/install

Graphene os used to be Copperhead os. I'm not sure how much info is still on the Copperhead website, but there used to be a good amount. If it's still there, it might be applicable to "older" phones, as in Oreo and nougat? Maybe even older, the flavors all blend together.
[OnePlus 5 Guides, News, & Discussion] schiavone.dimitri.2:
Well thanks for the info, for me personally it is enough to know that my phone wasn't tampered while I left it somewhere or when sleeping. Signing the boot image atleast means i can always check if the fingerprint of my key has changed at boot time. I also would like to avoid someone to just randomly accessing twrp and formatting my data(would be annoying to set things up again, even though I do regular backups). For the last part I did like was mentioned in the last post before mine and while it is secure it means that if somehow I cannot boot into the rom, I am completely locked out.

Inviato dal mio ONEPLUS A3003 utilizzando Tapatalk
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Signing boot image and TWRP only (not the rom itself) with Oneplus key represents no security issue. If your bootloader is locked, access to fastboot is closed: no one can flash anything via fastboot including stock images. If an attacker has access to your TWRP, he can flash anything he wants to. As far as boot image, all he needs is a self-signed (by any key) image: newer phones bootloaders allow that. If your bootloader is unlocked, you don't need signing at all: your device is wide open anyway.

Magisk will re-sign a boot image that was initially signed. You can custom build Magisk with Oneplus signing key. You can also put Oneplus key into the boot signing zip and run it after Magisk to get rid of the warning. Also, you don't need to unlock the bootloader to update firmware: not on stock and not on custom roms.
[OnePlus 5 Guides, News, & Discussion] gee one:
If magisk is resigning the boot image, that means that the keys are in the zip. It won't break the boot, but it does break security.

The question was about locking down the recovery, which would involved using private keys that aren't publicly available. Using the test keys is fine if you just want a working build, but not OK if you want the security. I know this is the one plus thread, and that it is a unique exception because they sign with the test keys.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
As I have already said, if your bootloader is locked, it doesn't matter which key is used to sign the kernel. As long, as bootloader is locked, no one can flash anything, including stock via fastboot. And if you erase TWRP, as I suggested in an earlier post, no one can do anything with your device. Signing a rom is a different matter: there, you definitely don't want to use AOSP keys.

Locking recovery: It is only possible on stock recovery, not TWRP. In stock recovery a file signed with a different key won't even show up. See here: https://mjg59.dreamwidth.org/31765.html
[OnePlus 5 Guides, News, & Discussion] gee one:
OK, I get you about the difference between signing the rom and signing the boot.img.

Also, about the recovery, some of the custom ROMs add extra recovery keys so that the recovery can flash roms signed with their private keys. This is legit for their custom rom, but if you want to secure recovery, you have to remove the ota keys. The link you posted well do this since it's replacing/repacking the ramdisk.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
I don't think this is related to TWRP, but rather to a custom rom, which has to be built (including kernel) with verity enabled. In that case, TWRP will check for verity, and obviously won't flash another rom. But this offers ZERO security, because all that's needed to go around this is wiping the rom + data + kernel, and then you can flash whatever you want regardless of the private keys. Also, you wouldn't be able to use root, as Magisk automatically disables verity in kernel.

TWRP, despite its convenience, is a major security hole, especially the feature that allows pressing cancel on encryption prompt and having the ability to wipe the phone or flash another kernel or rom or firmware. There should be no access to any partition until encryption credentials are entered, and data mounted.
[OnePlus 5 Guides, News, & Discussion] schiavone.dimitri.2:
I think that we should focus on bringing the same security features to custom ROMs as the stock ones and increase those parts that are lacking like TWRP for example. As things stand right now you either choose freedom and cannot use some security features or stay stock and think you are secure(I mean they discover vulnerabilities every day and those affect even phones with locked bootloaders and verified boot). Vendors should come up with user settable security by default and I mean signing with own keys etc. I mean in my laptop with uefi I own my secure boot keys plus the tpm chip and have no compromises, I don't see why cannot we bring that to Android.

Inviato dal mio ONEPLUS A3003 utilizzando Tapatalk
[OnePlus 5 Guides, News, & Discussion] Pierre02:
Hi!

Signing a recovery and then flashing it trough flashify or terminal is fine?
[OnePlus 5 Guides, News, & Discussion] optimumpro:
Doesn't matter how you flash it, as long as recovery is installed.
[OnePlus 5 Guides, News, & Discussion] Raj dholakia:
can you please share the step by step process to achieve the same result? I would like to do the same for one plus 5. Mainly how to use AOSP verity keys.
[OnePlus 5 Guides, News, & Discussion] strongst:
Hmm, the step by step instruction are within the first post of this thread(1-13) exactly for oneplus 5.
[OnePlus 5 Guides, News, & Discussion] Raj dholakia:
I have performed all the steps and got exactly the same results as I should get. I specifically want to sigh my twrp with AOSP keys. So I don't get any message on boot. And my Netflix works in HD with bootloader unlocked and root.
[OnePlus 5 Guides, News, & Discussion] 947432168@qq.com:
Is there anyone has success relock bootloader with custom android 10 rom and latest twrp?
[OnePlus 5 Guides, News, & Discussion] RMarques:
Sup guys,

I just bought an OP6 and I'm selling my OP5 6/64.

I'd like to re-lock the bootloader, unroot and to install the latest stable Pie on the OP5 in order to sell it on it's stock state.

Can someone point me to the right direction?
[OnePlus 5 Guides, News, & Discussion] strongst:
This is the wrong thread, it's for custom roms.

One simple guide: https://xdaforums.com/oneplus-5/how-to/oneplus-5-unlock-bootloader-flash-twrp-t3624877/post80133795
[OnePlus 5 Guides, News, & Discussion] RMarques:
Thanks for pointing me elsewhere man. Any staying point is a starting point atm. I've searched around during my whole lunch break without any luck on finding a guide to those specific tasks.
[OnePlus 5 Guides, News, & Discussion] optimumpro:
TWRP works fine. With the rom, It is possible, but only if kernel is signed during build. On device signing is no longer available, which means, you can't use Magisk.
[OnePlus 5 Guides, News, & Discussion] canteo:
Hi dev, i don't know what i'm missing, i get this:

canteo@canteo-Lenovo-Z50-75:~/Descargas/bootkeys$ java -jar BootSignature.jar /recovery recovery.img custom.pk8 custom.x509.der recovery_signed.img

Exception in thread "main" java.io.FileNotFoundException: custom.x509.der (No existe el archivo o el directorio)

at java.base/java.io.FileInputStream.open0(Native Method)

at java.base/java.io.FileInputStream.open(FileInputStream.java:219)

at java.base/java.io.FileInputStream.<init>(FileInputStream.java:157)

at java.base/java.io.FileInputStream.<init>(FileInputStream.java:112)

at com.android.verity.Utils.loadPEMCertificate(Utils.java:214)

at com.android.verity.BootSignature.doSignature(BootSignature.java:241)

at com.android.verity.BootSignature.main(BootSignature.java:316)

had install linux mint one week ago, java is version openjdk version "11.0.6" 2020-01-14

OpenJDK Runtime Environment (build 11.0.6+10-post-Ubuntu-1ubuntu118.04.1)

OpenJDK 64-Bit Server VM (build 11.0.6+10-post-Ubuntu-1ubuntu118.04.1, mixed mode, sharing)

thanks in advance, trying to sign last bluespark recovery
[OnePlus 5 Guides, News, & Discussion] optimumpro:
It tells you right there what's wrong: you are missing 'custom.x509.der' file. Terminal commands must be run from the directory where you have all the files. If you do have the file, check for spelling.
[OnePlus 5 Guides, News, & Discussion] canteo:
i am sorry, i don't know why, but didn't ran the second line for public key....all is fine thanks:good:
[OnePlus 5 Guides, News, & Discussion] MZGSZM:
Curious if anyone has tried this method recently and had success getting it working on an Android 10 ROM with 9.0.X firmware and WITH Magisk. I've been able to get the bootloader locked with Havoc v3.3 installed, but as as soon as I try to add Magisk (and use the boot signer) I get a "your device is corrupt message".
[OnePlus 5 Guides, News, & Discussion] LinAGKar:
Would this allow passing SafetyNet on LineageOS, now that it uses key attestation to verify the unlock state?
[OnePlus 5 Guides, News, & Discussion] d1n0x:
Does this also apply to newer firmware like 9.0.11 or the recently released h2os 10 firmware?