yashsingh1/xdaforums huggingface dataset:
[OnePlus 6T  Guides, News, & Discussion] themustached:
for those of you all who fiddle with this, be careful and don't do smt mode unless you wanna lose your imei. I was able to restore it out of some dumb luck and a hex editor, I enabled a mode to do a backup a few days back when I was first playing with this tool that allowed me to get where I needed to go. I have flashed a few boot images just to see what would happen and it gives me this device is corrupt.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
We figured this out fiddling with critical partitions a little while back, it's why we encourage backups before messing around.
[OnePlus 6T  Guides, News, & Discussion] themustached:
Miraculously I had one. Because doing this with the bootloader still locked is a pain in the backside. I have been able to bypass a the OEM unlock though without having to deal with TMO. My next go round I'm gonna try and flash the international version.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
You have root access on a locked bootloader or are you just using the additional features of the msmtool that most are unaware of?
[OnePlus 6T  Guides, News, & Discussion] themustached:
Additional features most are unaware of. Msmtool has a readback mode, that'll save partitions to your root drive. Which saved me because that's what took and hex edited into the .ops file to restore my imei.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
Interesting, I wonder if we can use this to bypass the unlock token restriction somehow....
[OnePlus 6T  Guides, News, & Discussion] themustached:
Probably. That's why I'm gonna figure out flashing the international variant. Because I can get it to flash edited things. Just gotta edit the the .ops to make it seem the same. I found the spot earlier where I think it reads from.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
If you can get it to overlook the signatures somehow, you possibly can, though we may have to manually restore some things stored in critical partitions.
[OnePlus 6T  Guides, News, & Discussion] themustached:
If I can get it to bypass it, restoring will be a breeze.
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
This is what I love about the android world.. Users like this, that are willing to go the distance.. had a friend some time ago that said, Android was dying because its so locked down, I told him that isnt true,

all its doing is opening up a challenge for the people that love it.. All this lockdown and trying to get around things just makes the users smarter as they figure out new and improved ways to do things.

Users like this and the many others out there that have sacrificed their device to find new and improved ways as well, so the majority of others can have a fast and easy way to enjoy their device

as intended.....

Just wanna say thanks to all that have helped with the continue work done on the T-mo oneplus 6T.......
[OnePlus 6T  Guides, News, & Discussion] :
Heck yes.. I second this.. keep it up man... I think its like unraveling a mystery.. i had someone giving me crap for flashing op6 mods and pretty much everything, after i posted it didnt work.. im like thats why android is an adventure.. we test and fail and keep learning.
[OnePlus 6T  Guides, News, & Discussion] themustached:
Just realised we can most likely have bl locked root with this method. I'm pretty certain i was getting errors because I was flashing with this but using a parched boot from previous version.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
This is what I was trying to find out earlier, if you had attained root using the tool, have you tried flashing the 9.0.5 patched boot with it? It is pre-patched for magisk support, just requires the app, if I knew what exactly it is you did, I'd be testing this myself right now.
[OnePlus 6T  Guides, News, & Discussion] AMRivlin:
Dumb question, but does this tool allow OEM Unlock, so I don't have to fiddle with Tforce/other?
[OnePlus 6T  Guides, News, & Discussion] themustached:
PM me on here and I'll give you my telegram. I can explain it.

---------- Post added at 02:46 AM ---------- Previous post was at 02:44 AM ----------

Yes and no. You can get it with this, but you'll lose your imei if you're not careful. But currently just if you're just an everyday user I wouldn't do it. It's a pain to get back up and running.
[OnePlus 6T  Guides, News, & Discussion] AMRivlin:
Interesting, I have 2, one for the wife and one for me. I'm a tinkerer but will observe for now. would love to get dual SIM up and running for dual work Sims etc.

Sounds like a "developing" situation. I'll follow you and see how this progresses.

Great stuff.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
If your bootloader is unlocked, we've already got dual sim functionality with the conversion.
[OnePlus 6T  Guides, News, & Discussion] AMRivlin:
Mine are factory... (Tmo)
[OnePlus 6T  Guides, News, & Discussion] BIGWORM:
I've always wondered, did anyone who have ran the tool check to see if the program "phones home" or downloads proprietary files?
[OnePlus 6T  Guides, News, & Discussion] nima0003:
Yeah the T-Mobile edition has dual sims working with bl unlock.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
I’ll log it later and see, can’t remember seeing it requesting network access though, since the .ops file should contain the full device image and windows is very restrictive with network access.
[OnePlus 6T  Guides, News, & Discussion] :
I think it just uses the files locally within the tool
[OnePlus 6T  Guides, News, & Discussion] LLStarks:
How do I safely OEM unlock without contacting Tmo using this tool? If that works, that's literally the last reassurance I needed before buying.

Will this tool allow recovery from accidentally taking international OTAs using the updater and bricking/mismatching?
[OnePlus 6T  Guides, News, & Discussion] :
U cannot. This tool relocks the bootloader and enabled the oem lock. Unless theres a feature I haven't found yet..
[OnePlus 6T  Guides, News, & Discussion] LLStarks:
themoustached is investigating something. We'll have to see.
[OnePlus 6T  Guides, News, & Discussion] :
Yeah i hope .. i think if we can modify or patch the firmware in the ops file, at least the boot. Img or aging. boot. Img with magisk, before using the tool it may work even with the locked BL. U can flash the aging boot from aging test mode within the booted up OS(*#806#). If we can patch it beforehand, then run the msm tool, then once booted up flash the aging boot. Img, we can maybe root the stock os with a locked BL...the aging boot has minimal security from what ive seen when unpacking it
[OnePlus 6T  Guides, News, & Discussion] dami00976:
Can I use this tool to convert my tmobile oneplus to international?
[OnePlus 6T  Guides, News, & Discussion] :
This tool does this:

https://xdaforums.com/oneplus-6t/ho...plus-6t-msmdownloadtool-t3868916/post78199440

This guide helps do this:

https://xdaforums.com/oneplus-6t/how-to/guide-flashing-t-mobile-oneplus-6t-to-t3865966/post78131430
[OnePlus 6T  Guides, News, & Discussion] dami00976:
Sorry I didn't quite specify... I'm bootloader locked.... And already checked on the other post for the international tool and it won't work because RSA signiture
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
deleted, Because I figured out the problem..... but thanks.
[OnePlus 6T  Guides, News, & Discussion] :
Unplug, try to power off or reboot to Bootloader
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
thanks man, I figured it out, just had to hold all vols and power same time for a bit and then it kicked back in and rebooted.............

OP is new to me.. and never used firehose programs and so on.. but heck, learn something everyday..

but at least I know how to get in and out of that mode..
[OnePlus 6T  Guides, News, & Discussion] :
Yea no prob man i keep bricking this every way i can ...i figured out the password for smt mode if u need it for some experimenting... Supposedly one can wipe EVERYTHING with it, we wonder if we can flash the intl ops file with this method using factory msm. exe
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
problem is you wipe your IMEI, also as someone pointed out, there is a hash value to the certs in a unwriteable place, and if this is true, no way to change that... But as each day goes on and the new stuff people

are finding out, im starting to rethink that statement.. It just might be possible.. Just gota play with the tool and all and see whats up. I already know about the hidden function READBACK

https://github.com/bkerler/oppo_decrypt <--- this will enable it.. as well as other things.....

Wonder if there are more things that are hidden or something, since this is the first time OP released by carrier and had to do this lock stuff, Nobody would of cared to find all that stuff before..

but Now, there is a reason.. so im sure as time goes on more and more things will be discovered.. im just learning as read others try dif things.......
[OnePlus 6T  Guides, News, & Discussion] LLStarks:
I've had to restore my IMEI before on a older phone. Not fun. Dealing with the bit order drove me nuts.

Wouldn't we also wipe the 2nd IMEI that is on the device yet not readable?
[OnePlus 6T  Guides, News, & Discussion] dami00976:
This method is use on the OP5t and when stuck on fire hose but on the downloading you have to do a key combo and it goes through... I'm a download and basic investigate but nothing to hardcore since i can't risk bricking my phone just yet... I have a tmobile locked version of OP6t
[OnePlus 6T  Guides, News, & Discussion] :
Oh sweet, i am more of a linux user, so i gotta install python on windows... yeah we gotta Just keep exploring
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
Just checking to see what is inside this tool, and came up with this:

https://photos.app.goo.gl/kAK9uQ3AQLhfFhiW7

as how to access or if anything is of use, that I will leave up to someone else.. but some of that stuff is interesting...
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
I was testing some things, and came up with this:

https://photos.app.goo.gl/tcq2Rmvcx8Qgr6Ny6

As you can see if link works right, that I added extra missing menus at the top, but I dont know each and every code, so I picked 33002 and this lic thing showed up.

trying to find the correct menu for the Engineer mode..

ohh yeah, them Extra options I enabled do work.. I didnt test with device connected, not that brave yet.. but I did check for functionality..

All work.. that screenshot was from a active running one.
[OnePlus 6T  Guides, News, & Discussion] themustached:
I know how to get to one screen with this tool. I haven't been able to do get to the others though. I've seen in a disassembler where there are other toolbars but haven't got them enabled yet.

There are a few switches that I've found. Nothing that enables new menus from what I've found.
[OnePlus 6T  Guides, News, & Discussion] :
This is huge. Check your inbox.. enable what u can then try with the password..
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
I know Section 33001 is com setup, used for the SMT, and 33002 for lic token, and 33003 is to import license4.dat file.......

33004 - 33009 seem to do nothing as of yet.................... might need to have the device connected to test them sections..

im still trying to find the menu for Engineer Mode,
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
I dont feel much up to disassemble, can you tell me if you see ID's like starting with 33001 which would be the com setup dialog,

as 33002 would be the License Token Dialog and 33003 would bring up a dialog to import license4.dat file box.......

Trying to find the other ID's but having no luck on that.. I pretty much got alot enabled.. just need to find the correct ID locations for the other stuff..
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
Anyone wanting to play with a Modded version of This T-mobile MSMDOWNLOAD Tool, I have updated it here,

What I did was, enabled readback mode (lets you backup your devices firmware)

Must setup what to backup in menu: Engineer Mode, readback Settings,

The password is listed below the textbox, PW: oneplus (Its default password, Not something I added)

a few other things have been enabled, but nothing much you can do with them... I am still trying to track down the ID's for Engineer mode and so on..

Not much luck at this time..

Also hidden hotkeys, F8 = open readback settings,, there is also F5, but I dont know what that does yet.

also F10, but that opens device manager, and there is Control+L, and I have no idea what that is...

Note to all: If you have no clue what this is or why its used, Then DONT try it. I only posted this for

the users that want to test it out, KEEP backups of your paritions, Mainly your IMEI..............

Nobbies: Please dont even try this one.......

Screen shots listed as well.. Or should I say screen SHOT..
[OnePlus 6T  Guides, News, & Discussion] :
So far from all i can tell, if we set the backups of the important stuff, the smt flash will wipe Everything, totally.. but its too early to say if this goes around the checks or not. I think it may upgrade runs checks, wipe should not. But do we take a plunge and transfer the intl ops file into the tool and fire it up? That is the 1000$ guestimate..
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
I'm tempted to try this...
[OnePlus 6T  Guides, News, & Discussion] AMRivlin:
Does this remove the OEM lock?
[OnePlus 6T  Guides, News, & Discussion] shusuke028:
So this is important because this would assist in us getting around the checks that are run while flashing the criticals for the International OOS right? Just want to make sure I'm following correctly
[OnePlus 6T  Guides, News, & Discussion] thedrizzle:
Hoping you guys can help out, I feel like I'm bricked.

I'm on the TMO variant, BL unlocked, had flashed to 9.0.5 international, rooted, then tried to flash to 9.0.6, and that's where everything went to hell.

Basically, no matter what I try to flash now (including using this tool), it fails on vendor.img. Any advice?

Thanks guys.

EDIT: it was probably my USB hub. Just for ****es n gigs, i went directly into my laptop USB port and tried again...disco. Might want to remind people of this just in case they run into the same garbage i did.
[OnePlus 6T  Guides, News, & Discussion] :
Be careful, im just theorizing...worst case it wont do anything..i tried it with everything normal..said mismatch md5, so i think the md5 has to match it all, program and ops files
[OnePlus 6T  Guides, News, & Discussion] juancastro86:
Can you use this app to update the software on the phone. I have a tmobile version and I need 9.0.5 thanks.
[OnePlus 6T  Guides, News, & Discussion] dami00976:
The question I think everyone is trying to ask is if this will work to flash international version to be able to unlock bootloader? And then should it work on tmobile version bootloader lucked?

I don't think it'll work just yet. Use the tool for research and investigation and yeah backup but don't try anything funny you might mess up your device.

Thanks for your findings guys great work
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
This tool can do much more then you think, we already know we can bypass the SIM unlock to enable OEM unlock in developer options.. we also already know we can gain temp root

and many other things on a locked bootloader.... Which I wont explain all that since its not my finding...... I just felt the need to explain that this tool is more powerful then one might think..

if you bought a international 6T then all what I said means nothing. but if your on a T-mo edition 6T, then everything we are testing and doing means alot......

But there are some people out there that will test something without really knowing whats going to happen, and in the end, it will damage their device or less wipe their IMEI and then asking us how to fix that.

Everything i said so far requires alot of work. so its safer that normal users Not test things like that...... at least till we find a safer and more direct way.............
[OnePlus 6T  Guides, News, & Discussion] dami00976:
Wait there's a way to bypass oem unlock on t mobile op6t?
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
No, not OEM unlock, I said SIM Unlock, which would allow you to enable the OEM unlock in developer options..................... but again, its not my finding.. and its alot of work..

if and when the person that found all this out decides to post, that will be up to him..
[OnePlus 6T  Guides, News, & Discussion] dami00976:
That's what I meant sorry about that... OK.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
This tools work on both locked and unlocked bootloaders. What you’re allowed to do is limited by your lock status as their are security checks in place on a locked bootloader to prevent security issues of course.
[OnePlus 6T  Guides, News, & Discussion] themustached:
Delete
[OnePlus 6T  Guides, News, & Discussion] dami00976:
Probably my message was misunderstood... This message was meant for people who arend advance and as an advice... I know you guys know what your doing... Just saying. And thank to all
[OnePlus 6T  Guides, News, & Discussion] :
I knew the hint was aging kernel... Nice
[OnePlus 6T  Guides, News, & Discussion] themustached:
Hate to do this, but just to show you the power of a little hex editing and msmdownloadtool. I'm also bootloader locked. I'll be out today as it's Thanksgiving. But I'll explain more later. I have aging mode kernel rooted.
[OnePlus 6T  Guides, News, & Discussion] AnonymousTipster:
Great work to everyone who found this stuff out! This is exciting times indeed :)

Before you say it's useless for people that have the international/factory unlocked model, don't. I think this is actually quite groundbreaking! Being able to have Magisk installed, flashing arbitrary images, AND have the bootloader locked the whole time: this means, Widevine should remain L1, correct? Which means, root AND HD (DRM) video playback should finally be possible. (HD in Netflix, Amazon, etc and not being constraint to 540p)

BTW: I found some more potentially interesting menus to be unlocked: https://i.imgur.com/ZedGjI8.png (Not sure what the implications of this is yet)
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
Ooops:

This is a repack, of my last update, cause messed up loading.. This one should work..........

re uploaded once again.. made another mistake..
[OnePlus 6T  Guides, News, & Discussion] BIGWORM:
I'm definitely looking forward to that development!
[OnePlus 6T  Guides, News, & Discussion] LLStarks:
OnePlus security is just hilarious.

I remember: https://www.xda-developers.com/oneplus-2-tampered-secondary-bootloader/
[OnePlus 6T  Guides, News, & Discussion] hartleyshc:
Have you or any one you've been communicating with on this been able to decrypt and extract the ops file?

It's my understanding that the ops file contains the programmer mbn file, XML file, along with each partition in mbn/elf format (which is proven by the dumps from read back mode). I know these ops files are signed, but has any attempts been made using QFIL to flash these files to the phone? It's all flashed using Sahara. And should at a minimum allow for flashing the read back backups.
[OnePlus 6T  Guides, News, & Discussion] LLStarks:
I'm still confused as to what we can and cannot flash now.
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
When it comes to the decrypt stuff, I am the wrong person for that job, but after doing a little research after reading what you posted, I think your right.. we just need someone to help with decrypting

the ops file.... and the guy that posted the link above, seems to still be the case when a guy can put root on his aging kernel and bypass all security with it..

As I said before and will say it again, Oneplus is the most relax on security then any device I ever came across.

But yeah, we just need someone or something to decrypt the ops file and then extract that stuff and try it.... I am just not the one for that job.. we need someone that knows their stuff into that area..
[OnePlus 6T  Guides, News, & Discussion] hartleyshc:
Decrypting is possible and someone has already done the hard work. (Hint; it uses the same encryption as the oppo ops files). But it's only decrypting, it's not decompiling the ops file. You might be able to wing it manually by hand, but that's honestly way too much work than I'm ready for. I was decrypting the ops file in blocks, because I was doing it on my laptop and not on my server. (Ran out of RAM). I was mainly looking to get the programmer and XML files so I could flash my own backup. There was only a handful of partitions I needed to flash and my partition table was still in tact.

The msmtool for TMO came out and that pretty much stopped my research into that. But seeing how others are actively looking into it. I might start going back into it and share a dump of an unencrypted ops file and let someone else look into decompiling it into individual files.

I'll post up something this evening/tomorrow.
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
That sounds like a plan to me.. its a start.

Do you mean something like this:

Found MAlloc: be60f0
Found MAlloc: be61e0
Detected AES: bf16a0
Found MAlloc: c9f088

[+] Seek: 0xf32b6000
[+] New DLength: 0x92880
[+] New DLength: 0x92880

[+] ReadFileLength: 0x1501f
[+] Subsize: 0x1501f
[+] New ReadFileLength: 0x92880

[+] ReadFileLength: 0x92880

[+] AES-Length: 0x92880
[+] AES-EDX: d41860b3
Data dump Data :
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............
Decrypted data was written to 'decrypted.data'.
Writing data.
[OnePlus 6T  Guides, News, & Discussion] hartleyshc:
Yep, exactly that. Like I said you can probably manually go through and find the starting and stopping points of each file. Possibly see any 0 data buffer space in between. But I'm sure it's a lot easier for someone to write a tool to do it automatically. And if you set the offset to the end of the ops file and do it in one big chunk, you can run out of RAM quick when doing it on a 4gb file. (at least on my crappy laptop). Was going to run it on my server, but again, the msmtool leak put a stop on that. My whole goal at that time was to recover my T-Mobile 6T, and do some research at the same time. I didn't want to run on my back up phone too long before I had to just return it and swap it with a new phone.

And that tool you quoted works on the International ops file. (I've tested and verified the decrypted data). I'm assuming the T-Mobile ops file is also signed by OnePlus and will follow the same encryption scheme.
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
I tried with the T-Mobile ops file and only got a decrypted.bin file of about 570kb then hit a profile error.
[OnePlus 6T  Guides, News, & Discussion] Eliminater74:
I tried with both and got same thing....................... but it was decrypted.dat for me not bin..
[OnePlus 6T  Guides, News, & Discussion] Dark Nightmare:
I’m afk, so couldn’t pull the proper name out of my head, sorry about that.