yashsingh1/xdaforums huggingface dataset:
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
The fix we had on essential that i keep referring to that restores verity without msm is made by invisiblek. U flash it in fastboot when u break verity. It bootloops till the verity is restored. When the red warning is gone, u then flash a normal kernel, and then are all good. Ill try to compile something tomorrow, but sift through his commits, find one entitled"f u c k verity". My friend [MENTION=5447216]aer0zer0[/MENTION] got blek to tell us..if anyone wants to mess with it here ya go https://github.com/invisiblek?tab=repositories

This fixes it

Oh yeah quickest way to break is flash stock kernel on a rooted os from within a kernel mg app, then reboot. Should break it. Causes to freak out.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
To disable red warning simply run: adb reboot "dm-verity enforcing" or from terminal: reboot "dm-verity enforcing"
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] twinnfamous:
We need to get this on a sticky
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
abl.img and xbl.img contains uefi firmwares (some drivers too), capable of booting android and windows os, like in pc's and laptops. xbl.img contains some kind of configuration and abl.img holds the Linux loader, that loads linux kernel. Actually the linux loader is pe file. Strings from linux loader shows Qualcomm used EDK II, which is a cross-platform firmware development environment for the UEFI and PI.

https://source.codeaurora.org/quic/la/abl/tianocore/edk2/

---------- Post added at 01:30 PM ---------- Previous post was at 01:28 PM ----------

It's actually packed with gzip or lzma
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
This doesnt work, have tried it. We need a boot that fixes it. I will make one?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] ozzmanj1:
Since I broke my verity a few days ago, where it pops up on reboot three times before then proceeding to boot up. I was about finally about to use msmtool this morning, but wondering if I should wait and see how this new creation your making will fix my phone without having to completely wipe and start from scratch.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
Nah wipe it man,i do it 4 times a week. Builds character

Lol.. nah just a slow worker
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Nsane457:
Yeah. The .p_offset of the PT_LOAD segment is the same offset of the UEFI PI Firmware Volume in the partition.

Using binwalk on the extracted LZMA, I get:

MD5 Checksum: 4bfa813f98e334401fd5698da0588c5e
Signatures: 390

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
8 0x8 UEFI PI Firmware Volume, volume size: 487616, header size: 96, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3
184 0xB8 Microsoft executable, portable (PE)
321581 0x4E82D Android bootimg, kernel size: 1986939136 bytes, kernel addr: 0x64696C61, ramdisk size: 1869570592 bytes, ramdisk addr: 0x6D692074, product name: "e Sizes"
360064 0x57E80 Certificate in DER format (x509 v3), header length: 4, sequence length: 861
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] saiprasadgawde:
I started fresh with MSMtool after backing up all my data. Now as a workaround to avoid the red screen I am doing all my TWRP stuff by just fastboot booting TWRP keeping stock recovery.

Edit - I just flashed stock boot.img through ex kernel manager and damn the red screen is back :(:(

So nothing to do with TWRP as I had thought earlier:eek:

I flashed stock boot.img through ex kernel manager in order to switch kernels

Its so damn annoying, wont be clean flashing through MSMTOOL for a while now. I dont mind the red screen but what bothers me is the need to press power button twice to boot up. Thanks for all those working on it. Hoping a fix comes through for us.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] tswb:
Can u get me the msmtool files and the stock rom for the international OnePlus 6t....
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] saiprasadgawde:
You could have just searched on the forum. Anywyas, here it is

https://xdaforums.com/oneplus-6t/how-to/tool-6t-msmdownloadtool-v4-0-oos-9-0-5-t3867448.

---------- Post added at 12:59 PM ---------- Previous post was at 12:44 PM ----------

Holy molly this worked, used terminal with the command and it worked, Can't thank you enough dude. U are a saviour:good::good::good:
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] _BГ@ckθut:
Thanks! This get rid a yellow unlocked warning...but not the red corrupt warning...looking for the fix red corrupt warning without msmtool;
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] H4X0R46:
So I came from a Nexus 6 before getting my 6t, and the dm-verity and unlocked bootloader screen could be bypassed by changing a simple flag in the boot partition, so custom kernels were able to achieve this. Is this not the case with the 6t? Does the dm-verity and unlocked bootloader screen lie in the bootloader for this device? My two cents.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] dreinulldrei:
I really doubt that. No way this command line should remove the orange bottloader unlocked warning. This command addresses dm_verity, which is a different thing.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] tswb:
Hey if I use this msmtool to restore back to stock to 9.0.5 and they said this will lock bootloader. Can I just unlock the bootloader again or I can't anymore.. just make sure
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
you can unlock anytime.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] tswb:
why I can't restore the phone. I follow the instructions and the msmtool said this

any help please I got the driver install correctly
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] HaiKaiDo:
It doesn't see your device. It has to be powered all the way off, hold volume up and down at the same time and plug in the USB cable.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Tung_meister:
Would it be possible to change the image? I'd find it less annoying if it didn't look like it was from 1980.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
which image ?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] ozzmanj1:
I just used msmtool to start from scratch. After that unlocked boooader and eventually restored my nandroid backup. Now it's back to where it was before
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] saiprasadgawde:
Dude u could have just used the *reboot "dm-verity enforcing"* command from terminal.

I had already clean flashed twice through MSMTOOL before AnoopKumar suggested this.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] nanodan:
I've confirmed that trying to boot a boot.img that does not contain MAGISK on a rom that previously had Magisk results in dm-verity failure, resulting in the device is corrupt screen.

If you use magisk and flash the stock boot.img and attempt to boot without flashing magisk again, your device will bootloop and show that screen. You can boot again by flashing Magisk, but the message won't go away. Issuing the command, "reboot "dm-verity enforcing" does seem to reliably fix this specific situation.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
Yup yup and yup. Format sometimes fixes it.usually gotta use msm.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] kiran8631:
Just go to android terminal and type

reboot "dm-verity enforcing"

Should solve problem
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] nanodan:
No, you just need to run "reboot "dm-verity enforcing"
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
Oh like with the quotes?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] nanodan:
Yes. Directly type in a terminal

reboot "dm-verity enforcing"

quotes and all.

I forced my phone into that "corrupt" state 5 times by not flashing Magisk and each time was able to get out of it with that command.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] saiprasadgawde:
Other simple way of avoiding the device is corrupt screen is to always use a magisk patched boot.img instead of stock boot.img whenever switching kernels. It also avoids the need of PC to install magisk again. Just remember if you had TWRP it will be replaced by stock recovery.

U can easily create a magisk patched boot image through the magisk manager.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Nsane457:
I'm pretty sure I found the assembly routine pertaining to the boot messages. Does this still matter to anyone or is it a pointless endeavor?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
Still matter to me at least. I was busy with some other stuff.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Nsane457:
First I extracted everything including and after the UEFI PI Firmware Volume section (i.e., dd if=abl.img of=abl.uefi.bin bs=1 skip=12288). I then opened that file up in UEFI Tool, navigated to the most nested PE32 image section and extracted its body to a file. I loaded that file in radare2 and performed analysis. I searched for the string "The boot loader is unlocked and software integrity", and when found, searched for any references to its starting address, 0x709c0. I couldn't find any so I searched for a regex with the first 2 significant hex digits (something like 70...) and found a reference to 0x70000. The assembly was adrp x22, 0x70000 which loads an offset address of a 4KB page. This is the 4KB page. It contains all those annoying boot messages. The code of the function with that line is here (at 0x0002fd70). Shortly after, there is a call to sub.Height___Width_overflow_a38 (at 0x0002fd84) followed immediately by cbnz x0, 0x30224. This same pattern is repeated several times shortly after (at 0x0002fda8, 0x0002fdcc, 0x0002fdf8). It would seem to me that sub.Height___Width_overflow_a38 is the implementation for displaying that text to the screen. Its code can be found here. I'm not that skilled in assembly so hopefully someone can take over from here.

EDIT: Edited to show correct extraction steps.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] twinnfamous:
This is great work you have done finding this info.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
its complicated than we think.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] dreinulldrei:
I assume the issue would be that the bootloader itself has a crypto signature originating from OnePlus. I would further assume that even if we'd find the routines showing these messages, assembling a new bootloader does not mean it'd be bootable. I would expect the device to not boot when it finds a bootloader that has been tampered with as it'd be breaking the chain of security.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
I was able to extract some bitmap images from xbl.img
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] tech_head:
Go back to *MY* post #3 where I said this.

This is part of the bootloader image.

Unlocking the bootloader does not unlock this partition/image at all.

This partition/image stays locked and requires the correct signed image to flash.

Modifying this partition will result in a bricked device.

I work in the ASIC/Chip design field. I have for almost 30 years.

I have done processor design, with among other things ARM cores.

I fully understand ARM trust zone and secure boot.

You cannot boot without a signed bootloader and modifying the bootloader without the correct signature

WILL

result in a device that won't boot. You can look all day long, but you will not be able to modify anything in that partition and have a usable device. This is a fools errand unless you get signing keys.

Being able to change that image would allow anyone to install a corrupted version of the OS that steals data at will.

Bypassing that image is not something any vendor is going to allow you to do and they are going to go out of their way to make sure that an unlocked BL displays that message.

They have done this as a security measure to make sure the agencies with three letter acronyms can't modify the software and piggyback services. Thieves can't get a batch of phones and replace the ROM with a data theft version and send them into the world.

The issue is not just encrypted phones. Crooks and the governments hate signed images and partitions that they can't modify.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
I agree 200%
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Nsane457:
Oh well. I guess it's not possible. The 10 second rule is apparently part of the ABV 2.0 spec:

I did see older threads that showed the command fastboot flashing unlock_critical to unlock critical partitions but that doesn't work for this phone and fastboot oem device-info shows the value as unchanged:

(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
(bootloader) enable_dm_verity: true
(bootloader) have_console: false
(bootloader) selinux_type: SELINUX_TYPE_INVALID
(bootloader) boot_mode: NORMAL_MODE
(bootloader) kmemleak_detect: false
(bootloader) force_training: 0
(bootloader) mount_tempfs: 0
(bootloader) op_abl_version: 0x31
(bootloader) cal_rebootcount: 0x31
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
There are many difference, in a flasgship device booting process compering to regular device. Flagship devices are more secure. My previous device was moto x play, by editing(hex) the string "unlocked" to "locked" in logo.bin, disables the unlocked bootloader warning. Which used the conventional bootloader.img.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] twinnfamous:
Not so sure a fools errand. There is some good info here. I figured the more we know how it works the better.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] tech_head:
Understanding is great. Don't expect to get rid of that screen without some signing keys.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Funk Wizard:
Subscribed :good:
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] dreinulldrei:
We do agree then, I assume? ;)
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Cj719:
So does this mean the image can't not be edited? Or is the warning not an image but just text on black screen? I remember in my HTC days when we could install a custom Hboot to get rid of the warning. Just shooting out ideas...is it possible to overlay an image over the current or if it is just text change pt of the font?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] MarylandCookie:
That was possible due to SOFF,
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
If the bootloader is unlocked, we can flash custom images. That means it's possible to change the warning.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] tech_head:
Go back and read post #3, 68, 69, 70

Even if the BL is unlocked there are partitions that you

CANNOT

flash without a signed image.

The bootloader may be unlocked to allow flashing other partitions but the bootloader partition still requires a signed image.

This is part of secure boot.

You cannot in anyway modify that bootloader partition and have the device boot.

Modifying that partition will break the hash that the device uses to verify the partition.

I will repeat.

Unless you get the signing keys for that partition from OnePlus, you are NOT going to get rid of that message.

---------- Post added at 09:38 AM ---------- Previous post was at 09:37 AM ----------

Yes
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
And even if bootloader is unlocked, unlocked critical doesnt actually do anything. When i send the command to unlock i do fastboot oem unlock_critical
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] H4X0R46:
I hope this gets figured out in time. My last device, the Nexus 6 was a simple flag that needed to be set in the boot partition. Custom kernels were able to take care of dm-verity. It's splitting hairs here, but the "your bootloader is unlocked" message is annoying for sure. I also wonder of there will ever be a chance we can safely decrypt our 6t. TWRP encryption has been.... fun to say the least.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Striatum_bdr:
As said two posts above yours it won't be fixed. Since OnePlus 3 this message exists in all OnePlus phones and had never been addressed as it's hardware driven
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] H4X0R46:
Shoot and that part is even bolded! My bad, that's my fault. Thanks for pointing that out!
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] foobar66:
I just noticed something. If you enable the advanced reboot settings, go and reboot into bootloader.

Then from a terminal type:

fastboot continue

Now the fastboot mode splash screen is shown (which can be changed), kernel is loaded and Android boots normally.

No RED or YELLOW screen was shown !

I'm not sure where the fastboot code exactly is but if we could patch it then maybe this could the start of a workaround?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] ZeroKool76:
I actually don't mind those messages. It reminds me that my device isn't secure, regardless of encryption status. I suppose, if you want it to go away, you should relock your BL. Just saying. You guys risk quite a lot, just for aesthetics
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
I have tried this in fastboot and and when the message is on the screen. I have given the command and it doesnt read it. Have to msm to remove. There are types of broken verity i run into, one where i can boot and one where im stuck in bootloop or recovery. Both instances i give command, either with or without adb prefix or fastboot attached. Even, tried just reboot "dm-verity enforcing". Can someone humor me as to when and where if this is to work, how would one do so? I have tried it with op6 oos, op6t oos, custom, treble, all of them. Nothing. what am missing?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Cj719:
I was able to use this command when I was trying to get the McLaren booting. My state was i could boot and this would change the red to yellow. When I was in recovery loop it did nothing.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] nanodan:
It's not a fastboot command.

You type it from an adb shell or a terminal on your device when it's booted, so it obviously won't work if you can't boot (which implies you broke something else other than dm-verity anyway). That corrupt screen is a flag so it'll persist after you fix whatever was causing the bootloop. The "reboot "dm-verity enforcing""command just flips the flag. If your phone is still corrupt but can still boot then it'll just get flipped again when you reboot.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
Ok thanks.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
This sounds promising cause it shows there's a way to not have that message! We just gotta find a way as you said to pass that command while booting and not needing a PC to send that command
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] partcyborg:
Being able to modify the bootloader partitions and still boot is gated on the "critical unlock" fastboot command on Qualcomm devices.

The above poster is mistaken about it "never" being possible to modify these. Critical unlock is absolutely available for the pixel 2 devices for example.

I haven't tried the critical unlock on my device yet (as I just got it today and have been setting it up etc.) but I should have some time over the holiday at night to mess with this some.

[MENTION=225651]op[/MENTION] GREAT find on the structure of abl, I banged my head against that on the Samsung s8/s9 devices forever! With the info you found I should be able to get a full decompile to c in Ida pro. I'll take a poke at that too.

Someone should try toggling critical unlock though and see if these phones allow that level of unlock too, also I could see it differing between ones from tmo and ones direct from onepluss too.

Excited to finally have a device with some fellow devs to hack on it with! Perhaps we should get a telegram channel going to communicate in more real-time?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] krabman:
They added that in on the P2 and later took it away, you can still use the command but it wont actually flash critical. I tried it both here and on my P3 and it didn't work but then I've no skills per se so someone else may make headway with it.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
Have you heard of EDK II ?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
I have since day one unlocked critical as we did with my previous device, essential phone. After flashing the unlock bin, to unlock bootloader, as i have the tmo version converted; i run fastboot oem unlock_critical. It accepts the command and unlocks the bootloader. But we still do not have individual critical partition capability. I know the intl op6t can dd everything, but us t mo folks get hardware mismatch due to rsa checks if we do so. The only way i have been able to update my critical partitions is via local upgrade flashes of ota full roms. I tried reaching out to OnePlus to remedy this but they dont understand what we are asking. Some of my colleagues have made huge strides in decrypting the msm tool with hopes of enabling full development mode/engineer mode. So maybe one day we can all truly unlock.critical. then we could disable checks and everything else and flash a modified abl. Has anyone ever use that hidden fastboot command tool u run against abl or aboot to find hidden oem commands, if we could get that command to enable full.development mode in order to unlock critical?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] :
Nice work, out of thanks. Merry Xmas
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] naxalite971:
I'm okay with a political screed or manifesto!
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] Causical:
Wow you guys are doing some REALLY cool stuff... Super Jelly, don't know what most of it means, but sounds pretty awesome. Keep up the sheer badassery ?
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] partcyborg:
I have, I just know my way around Ida pro a little better. Granted, I'm still pretty noob at all stuff at this level. Getting the code back to c, even if it's horribly low level nasty c, is much better for me because I don't really know arm assembly
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] AnoopKumar:
on Windows abl.img can be unpacked using 7zip. LinuxLoader.efi is a pe file.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] partcyborg:
I managed to get the abl image opened up in Ida pro. I can probably put together an image that at least blacks out the screen instead of the warning. The only question I have is do we have the firehose programmer for the op6t? Because if this goes south it will dump me in edl, so it will be important to have an out prepared. Does that msm tool op6t recover a corrupted bootloader? Sorry I've been with the family for the holidays and haven't had much time to read up on much.
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] foobar66:
I flashed a new abl.img image a few days ago and my phone appeared dead. Literally: 0xDEAD ;)

Had to use a WIN pc to recover using the MSM tool. It uses some low level qualcomm protocol.

Phone was fully restored to stock.

Check this post:

https://xdaforums.com/oneplus-6t/how-to/tool-6t-msmdownloadtool-v4-0-oos-9-0-5-t3867448

Some other stuff which I found:

https://alephsecurity.com/2018/01/22/qualcomm-edl-1/

https://github.com/alephsecurity/firehorse

But touching the limits of my own knowledge / capability here ...
[OnePlus 6T  ROMs, Kernels, Recoveries, & Other Dev] twinnfamous:
I wonder if the msm tool is built like the htc ruu. If so it should be easy with the right people working on it.