yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 Original Android Development] DragonFire1024:
LMFAO I can't ****ing believe this. I'm almost certain this will work on the HD 10 too. You found it before me. Absolutely brilliant. You've just proved many weeks and or months of my hard research that I've posted in more than a few threads between the fire 7 forums and here. You just happened to be a lot quicker at this and probably smarter. ACM I discovered a few weeks or months ago on the HD 10. There is a build file that has many ways to set ACM props. doing this made everything light up on my PC...new drivers were installed and being used including the preloader drivers. I set my test HD 10 to persist ACM since then, convinced it was one of the possible keys to the puzzle. If you've read anything I've done in the past several weeks and months you may have been the only one who truly believed anything I had been saying. I don't know who you are or where you came from but I can only thank you. You've made my day, my week and my year. At least now I can say I'm not crazy, hallucinating or 'don't know what I'm doing or talking about.' it will take me a few days to get started, but I'll get right to testing my test HD 10 in the next few days or so.

Edit: I was convinced it had to do with fos_flags too, which I believe is another way to unlock.
[Fire HD 8 and HD 10 Original Android Development] xyz`:
The vulnerability is present on every mediatek device, so yeah. It will not work as-is because of different addresses (for the crypto device and offsets for LK). Additionally, on Fire 7 7th gen the eMMC test point is hidden behind the shield that you need to desolder, so you will probably want to find a different way to enter the bootrom download mode.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Great work!

This is very promising could you please elaborate, what exactly needs to be modified to port this to other MTK-hardware.

I have a fire 5th gen here and I can access brom-mode by pressing left mute button while pluging in.

tried your scripts as is (commenting out the parts that change rpmb or flash partitions) and it get's stuck at

[2019-01-28 00:01:40.973289] Disable bootrom range checks

Does the hash in load_payload.py (4dd12bdf0ec7d26c482490b3482a1b1f) need to be modified?

I do have the kernel-sources for the device and am willing to investigate correct addressing etc.

Also since this is a boot-rom exploit wouldn't it allow flashing a hacked preloader + lk which just ignore boot-signatures so we can just run a standard twrp?
[Fire HD 8 and HD 10 Original Android Development] xyz`:
So first of all make sure you're accessing bootrom mode and not preloader mode (Although if the preloader supports read/write, the exploit should work there as well, I just haven't tested it since on hd 8 8th gen none of preloaders support these). I suggest soldering on a UART adapter, then use 115200 baud rate. When in bootrom dl mode, you should see "[DL] 00000BB8 444C0005 010701" (basically, the "[DL]" part is the important one)

If it's a different soc, you will have to dump the bootrom and find the offset where range check data is stored (in my case, 0x102868). You might have to modify the 4dd12bdf0ec7d26c482490b3482a1b1f part as well, it's basically calculated as a xor of expected data and actual data it's written. Then, you'll also need to update the pointer I'm overwriting (0x1028A8 in my case, called ptr_send in brom-payload). Again, if executing under preloader it's gonna be completely different way to exploit it.

Once all this is done, you should be able to load binary payloads and execute them in bootrom mode. You'll also need to edit brom-payload and set up proper pointers to send_dword/recv_dword/etc, these can be found by reversing your bootrom dump. At this point it should be possible to get emmc read/write.

Finally, if you want a persistent unlock (and not just the ability to modify /system) you'll need to port lk exploit as well. So you'll have to figure if your lk is vulnerable to the same bug, port microloader, inject_microloader.py and lk-payload to use the proper offsets. It's a lot of work.

I'll hopefully finish my writeup in the next weeks and post a link to it, that should be easier to understand since I'll explain the whole process from start to finish.

You're right about being able to load a custom preloader/lk, however the bootrom exploit requires a PC connection and a bunch of USB commands (so in a way, it's "tethered"). The actual unlock exploit isn't using any bootrom bugs, but rather the lk bug, since that one works without a PC. In fact, the bootrom exploit is only used to flash stuff to eMMC (but, of course you could probably do more fun stuff with it) in my chain.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Thanks for your quick reply.

I'm pretty sure I'm in boot-rom, my preloader actually has direct read/write using read_mmc.py but that has been fixed in newer preloaders, so I would rather go the boot-rom route.

Have you tried if pressing left (or both) volume buttons while pluging in brings you to brom-mode as well, like it does on my device?

I'll attach a serial to check for the output.

Any hint on how i would dump the bootrom? Also could you upload your boot-rom so I can compare once i got mine?

Willing to put that work in ;)

looking forward to your writeup.

I thought it might be possible to flash a preloader that exploits the same vulnerability, but from your explanation I assume that won't be possible.

For this device it would already be great to be able to overwrite RPMB to downgrade, since there was an LK that allowed booting into unsigned TWRP.
[Fire HD 8 and HD 10 Original Android Development] xyz`:
Yep, I've tried and it didn't work, though it could be device-specific. There are several additional ways preloader can force you into bootrom download mode, for example if preloader has an assertion and you hold volume down, it just deletes itself from emmc and next boot you'd be in bootrom mode (this doesn't work on hd 8 though as there's a bug in how it's set up); then there's some button checks that sets up a SRAMROM_USBDL which bootrom checks (but the code for the button check isn't present on Fire preloader). So unfortunately the only option that worked for me is shorting eMMC to ground.

This will be in the writeup, it's too long to explain here. I'm not sure if I can share my dump since technically it's copyrighted code.

Well, we only can flash preloaders signed by amazon. If you have a preloader/LK combination that doesn't have signature checks that's great, you can use that.
[Fire HD 8 and HD 10 Original Android Development] xyz`:
Also, here's what I used on my Fire 7:

def call_func(func):
sdr_write32(0x11010804, 3)
sdr_write32(0x11010808, 3)
sdr_write32(0x11010C00, func)
sdr_write32(0x11010400, 0)
while (not sdr_read32(0x11010800)):
pass
if (sdr_read32(0x11010800) & 2):
if ( not (sdr_read32(0x11010800) & 1) ):
while ( not sdr_read32(0x11010800) ):
pass
result = -1;
sdr_write32(0x11010804, 3)
else:
while ( not (sdr_read32(0x11010418) & 1) ):
pass
result = 0;
sdr_write32(0x11010804, 3)
return result

def hw_acquire():
sdr_write32(0x11010000, sdr_read32(0x11010000) & 0xFFFFFFF0)
sdr_write32(0x11010000, sdr_read32(0x11010000) | 0xF)
sdr_write32(0x11010004, sdr_read32(0x11010004) & 0xFFFFDFFF)

def hw_release():
sdr_write32(0x11010000, sdr_read32(0x11010000) & 0xFFFFFFF0)
sdr_write32(0x11010000, sdr_read32(0x11010000) | 0xF)

def init():
sdr_write32(0x11010C0C, 0)
sdr_write32(0x11010C10, 0)
sdr_write32(0x11010C14, 0)
sdr_write32(0x11010C18, 0)
sdr_write32(0x11010C1C, 0)
sdr_write32(0x11010C20, 0)
sdr_write32(0x11010C24, 0)
sdr_write32(0x11010C28, 0)
sdr_write32(0x11010C2C, 0)

sdr_write32(0x11010C00 + 18 * 4, [0] * 4)
sdr_write32(0x11010C00 + 22 * 4, [0] * 4)
sdr_write32(0x11010C00 + 26 * 4, [0] * 8)

def aes_read16(addr):
sdr_write32(0x11010C04, addr)
sdr_write32(0x11010C08, 0) # dst to invalid pointer
sdr_write32(0x11010C0C, 1)
sdr_write32(0x11010C14, 18)
sdr_write32(0x11010C18, 26)
sdr_write32(0x11010C1C, 26)
if call_func(126) != 0: # aes decrypt
raise Exception("failed to call the function!")
words = sdr_read32(0x11010C00 + 26 * 4, 4) # read out of the IV
data = b""
for word in words:
data += struct.pack("<I", word)
return data

def aes_write16(addr, data):
if len(data) != 16:
raise RuntimeError("data must be 16 bytes")

pattern = bytes.fromhex("6c38d88958fd0cf51efd9debe8c265a5")

# iv-xor
words = []
for x in range(4):
word = data[x*4:(x+1)*4]
word = struct.unpack("<I", word)[0]
pat = struct.unpack("<I", pattern[x*4:(x+1)*4])[0]
words.append(word ^ pat)

sdr_write32(0x11010C00 + 18 * 4, [0] * 4)
sdr_write32(0x11010C00 + 22 * 4, [0] * 4)
sdr_write32(0x11010C00 + 26 * 4, [0] * 8)

sdr_write32(0x11010C00 + 26 * 4, words)

sdr_write32(0x11010C04, 0xE680) # src to VALID address which has all zeroes (otherwise, update pattern)
sdr_write32(0x11010C08, addr) # dst to our destination
sdr_write32(0x11010C0C, 1)
sdr_write32(0x11010C14, 18)
sdr_write32(0x11010C18, 26)
sdr_write32(0x11010C1C, 26)
if call_func(126) != 0: # aes decrypt
raise Exception("failed to call the function!")

Try calling aes_read16(0) and see if it returns valid looking data (should start with "07 00 00 EA FE FF FF EA FE FF FF EA FE FF FF EA")
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
It seems to just hang with both aes_read16 and aes_write16.

It is probably related to the CRYPTO_BASE.

I tried finding the correct one here: https://github.com/chaosmaster/andr...ch/arm/mach-mt8127/include/mach/mt_reg_base.h

but didn't seem to find anything usefull (I tried CRYPTO_BASE = 0x1101B000, but that doesn't work either)
[Fire HD 8 and HD 10 Original Android Development] xyz`:
So what you can do is download a firmware update for your device, load up the preloader in IDA (or a disassembler of your choice) and search for "hw sha". You should see it used like this: https://i.imgur.com/1PcObV7.png. Then inside that function https://i.imgur.com/wvpq5Qm.png the first call is essentially hw_acquire, then hash, then hw_release. Going further https://i.imgur.com/D5Z9UoM.png. So the base in my case is 0x10210000. You should figure out at which point it hangs, if it's inside one of the while loops, make sure you call init() and hw_acquire() first (it's not always required, seems to be hw-dependent)
[Fire HD 8 and HD 10 Original Android Development] hwmod:
Porting the hack to Fire 7" 7th Generation

That was smart of you [MENTION=295159]xyz[/MENTION] a genial solution.

You have proven that the "chain of trust" was a joke.

Many have said that what we were trying was impossible.

Did you realize on the 7" 7th Gen there are RST and EINT pads on the back of the photo I sent ?

Can we port your method to the 7th Gen by using RST instead of CLK to stop the MCU accessing the EMMC ?

Also the "watchdog" you disabled is on the RTC device of the MT6323 PMIC chip which in turn is on the I2C bus.

I can write to the I2C bus using a Bus Pirate v4, I already tried some write and seems I can do that too as an alternative.

Again the pads for accessing the I2C bus are on the back of the PCB of 7th Gen. tablets, they are labelled SCL2 and SDA2.

In a couple of week, or less, you have shown that Lab126 didn't deserve all that money for such a fake security mechanism.

I confirm that zeroing the "preloader" in "mmcblk0boot0" also forces the MCU to enter [DL] mode.

I was sure that investing time on the the [DL] mode would have paid back.

Again congratulation for the achievement and thank you for the time you have put on this.

.:HWMOD:.
[Fire HD 8 and HD 10 Original Android Development] xyz`:
I haven't tried with RST. Try it and see if you get a "[DL]" message on uart, if you do then it should work.

Yeah, I haven't investigated the watchdog too much. I don't think there's anything interesting you can do with it though.

To be fair to lab126 all of the fail lies solely on mediatek. The bootrom code amazon probably doesn't even have access to, and LK is likely based on mediatek sources (although, it's a really obvious bug in image loading, come on). The boot chain is reasonably secure in its design, it's only the implementation that's flawed.
[Fire HD 8 and HD 10 Original Android Development] k4y0z:
Sadly i don't have the IDA decompiler, so just assembler it is :/

I did however find the correct CRYPTO_BASE I believe:

CRYPTO_BASE = 0x11010000

that gives the following output with aes_read16:

b'\x07\x00\x00\xea\xfe\xff\xff\xea\xfe\xff\xff\xea\xfe\xff\xff\xea'

aes_write16 now fails with "RuntimeError: ERROR: Serial protocol mismatch".

Can i dump the boot-rom with this now?
[Fire HD 8 and HD 10 Original Android Development] NFSP G35:
First of all, congrats and big thanks!

So, any hope for the 2017 HD8?
[Fire HD 8 and HD 10 Original Android Development] xyz`:
Yeah, just go through all of the bootrom memory (0 to 0x20000, just to be sure, in 16 byte increments), call aes_read16 on it, concatenate everything and you'll get your bootrom dumped. It should end with a bunch of FF bytes so that's how you can tell the actual size.
[LineageOS News & Discussion] Osndok:
I've always found it kind of hard to pick "the next phone" to buy... especially since my interests seem to be orthogonal to what all the review sites focus on. This time around I found success by combining (1) the lineage os stats (what everyone else is having success with), and (2) the device wiki data (because I needed a special feature: dual sim slots).

There is one thing, though, that I think the device wiki is missing... and it is hinted at in this commit:

* https://github.com/LineageOS/lineage_wiki/commit/f489e78535360e09aaa7425d894e602e25e44760

Especially for one that does not follow modern trends, or who does not have a lot of time to weed out phones that are "popular but unofficial" (like the homtom) and research possibly-stale forum info concerning the bootloader (as I have bought several phones on such ground thinking they could be unlocked!); I recommend adding another enum field to the LOS device wiki to describe the current state of the bootloader.

Why? Not only would it save huge amounts of time for those searching out their next LOS phone, but it might also gain wider visibility into the "bootloader problem", subtly pressuring companies to produce favored unlockable phones, or at least not regress (as huawei has done).

I recommend a new enum field: bootloader_type

already_unlocked - The device ships from the factory unlocked. You might be able

to lock it, but why would you want to.

freely_unlockable - Unlockable without needing any sort of code, "phoning home",

or secret-sauce-software to unlock it. e.g. Nexus phones, oneplus phones

with_permission - Unlockable only with permission and interaction with a another

party, and that party is known to currently be issuing permission to anyone who

asks. e.g. motorola phones

jail_breakable - The device is intended to be locked up tight, but they failed.

Care must be taken as there is often a closing window of opportunity to use this

device before a firmware update removes its utility. Often shifts to not_permitted

(below) once the last known jail break is patched.

not_permitted - There may be an unlock mechanism, but it is generally infeasible

or secret. e.g. huawei

confusing - Phones with the same model number come with different unlockability,

or only special bootloader versions can be jailbroken, so extra care must be taken.

e.g. pixel phones
[Android Q&A, Help & Troubleshooting] adek89:
hello, I had the stock rom installed, I created a twrp, I wanted to restore copies of oreo but did not insert, I made the format anew oero and after the tablet shows the picture inofrmacja and in the good morning to give a password that was never what I now have to make him stand on his feet?

picture

https://imgur.com/a/B3NJGqQ
[Android Q&A, Help & Troubleshooting] daitalos:
you formated in oreo as ext4 or f2fs??

(requests password because your device is not decrypted)

for decryption needs format data & flash SuperSU or magisk ....

Read & here other way: (IDK your device)

https://xdaforums.com/android/software/universal-dm-verity-forceencrypt-t3817389

_when you had the backup, your data was in ext4

and now you have to format data (or repair) as ext4

(data & cache must be the same /ext4 )

Read in recovery,explains everything (warning:this data backup was made with ext4 file etc...change back to ext4!)

when you finish,reboot on recovery & try again ...

sry for english
[Android Q&A, Help & Troubleshooting] adek89:
I found a tutorial quicker to do the format on ext 2, then I asked for ext4 and helped
[Android Q&A, Help & Troubleshooting] daitalos:
there is no choice ext2 for data or cache format

you can format only as ext4 or f2fs (ext4 needs) you can read this, in recovery screenshot
[Google Pixel 3 XL Themes, Apps, and Mods] erkange:
I like the Samsung's phone apk, and want it to use on pixel 3 xl.

I downloaded few apk's from apkmirror etc but they didn't work.

Is there any way to make it work?
[Google Pixel 3 XL Themes, Apps, and Mods] Cozzeck:
Most likely not, you would need Samsung's framework installed to be able to use there apps. And installing Samsung framework on a non Samsung phone is something I've never heard of.
[Google Pixel 3 XL Themes, Apps, and Mods] erkange:
Any advice?
[Google Pixel 3 XL Themes, Apps, and Mods] Eudeferrer:
Buy a Samsung phone!
[Google Pixel 3 XL Themes, Apps, and Mods] gee2012:
As said allready not possible without the Samsung framework. Live with it or buy a Samsung phone.
[LG V20 Questions & Answers] AndroidForDummies:
I have read the guide to rooting for dummies. I am a dummy (C++ developer that really does not want to get into Android that deep)

I understand that the NO_DAMN_SCREENSHOT flag can be set by app developers, and this is beyond annoying, particularly from hotel booking apps that want to prevent me snapping their outrageous fees to confront them with

I understand rooting has some advantages, but I need banking apps to work and I really cannot spare a day to do this. Next I will be spending all hours playing with tweaks and I just cant.

I have loked at windows screencasting apps but .... groan... more wasted hours dealing with crapware and tons of command line apps to install...

I JUST WANT A SCREENSHOT ! urgh frustration.

Is the only simple solution to just use another cell phone camera... seriously. Ridiculous.

Since the V20 is now discontinued... thanks LG... perhaps I should buy a rooted phone while travelling in the east. Absurd.
[LG V20 Questions & Answers] Tim3tripp3r:
It's actually quite easy to take a screenshot with the LG V20. Everything is already installed (software wise).

1. See screenshot.

2. Using the 2nd screen - see the icon circled in red.

This is the icon for the app "Capture+" (stock LG app)

You can use this app to take screenshots and add annotations.

You might need to add the app to the second screen in the settings first. It's all there under the display section.

3. When you tap the Capture+ icon it brings up a new menu in the 2nd screen. This should be self explanatory. The "check mark" on the left side of the 2nd screen is where you save your screenshot.

See this link for Sprint info page on Capture+

http://eguides.sprint.com/support/eguides/lgv20/content/lg_v20_ug/capture.html

I hope this helps.
[LG V20 Questions & Answers] elcocolo50:
Hi.. other way for screenshot is press

volume down and fingerscanner at same time View attachment 4696760
[LG V20 Questions & Answers] pistacios:
The OP is looking for a solution to take screenshots in apps that don't allow it (ie. Banking apps and such).

I personally do not know of a workaround besides using another device to take a pic of the screen. I haven't tried a screen recorder app...might be worth a shot.

Edit: just tried a screen recording app on my banking app that doesn't allow screenshots...didn't work, black screen.
[LG V20 Questions & Answers] Tim3tripp3r:
The LG Capture+ app works 100% with my banking app for taking a screenshot.
[WebOS Software and Hacking General] banshee28:
Figured this has been discussed many times, but could not find the details?

Was wondering if there was a way to get a youtube app installed on Webos that will play videos without ads? I know it may need to be rooted, so if thats needed thats ok. It seems like there is a way root now with 3.5 or lower.

I know with Android this is easy with or without root. So would like to do the same with LG SmartTV running WebOS.

:D
[WebOS Software and Hacking General] NO_ob:
you can probably add the urls for the ads to the hosts file which should stop them from loading
[WebOS Software and Hacking General] banshee28:
Can I do that not rooted?
[WebOS Software and Hacking General] mojo-chan:
URL blocking hasn't worked for well over a year with YouTube. PiHole and the like are ineffective.

You need a modified app that doesn't play ads, like you get for Android. I don't think one exists for LG WebOS.
[WebOS Software and Hacking General] NN33NN:
Run youtube without ads on LG-TV

Have the Youtube app installed on the LG-TV (Useing this app direcly will always show adds on all youtube videos), if you have an android phone -Then google "YouTube Vanced" -its a modded adfree Android YouTube client, works on none rooted android phones. Run the app on your phone search for the Video then use icon to cast screen to the TV. Youtube app on TV will show the video without ads.

I guess you can do the same if you have iPhone and an youtube adfree app.
[WebOS Software and Hacking General] Delphir:
any update on this subject? unfortunately casting from Vanced is not a solution anymore, TV keeps showing ads which can be skipped after 5s of viewing. What is interesting - Vanced even displays a notification that TV is going to show the ad in a few secs
[WebOS Software and Hacking General] Agret:
I just went to https://rootmy.tv from my LG TV web browser and it installed the homebrew channel, from that I was able to install the adfree youtube mod and disable my TV checking for new updates which might lose my root. It also includes SponsorBlock in the mod so it will skip annoying subscription reminders & in-video promotions.
[WebOS Software and Hacking General] andreic.apopei:
Can you revert back if needed?

I have a 2019 model