yashsingh1/xdaforums huggingface dataset:
[Meizu M3 Note Guides, News, & Discussion] 99degree:
buddy you are welcome to visit here.

Frank speaking, there might not be always hold true for custom lk by some vendor. Samsung and moto have different lock stretagy. Althrough the code is common for mt67xx, Even I cant garentee for every mt67xx phone from same vendor does use same code piece it used from mtk.

So in your case i can provide more info for you to have a try. First you need to test fastboot boot with your boot.img and see if it works in half way. If there is invalid command, then you might not have chance to do something advance.

Please watch the youtube video above again. I grab the frp partition by hexview in twrp. The modification shown is quite clear at 3:39, the pattern at last is 0001 0000, and hexview skip all 0 pattern block in the middle. please have a check if you still wanna try. Please note different phone, frp size might differ, the above lk code require last dword set to 1 anyway.

Here are some basic info how to view hex code.

Repersenting 1 in double word:

Offset : 00 01 02 03 ...... 0c 0d 0e 0f

Value: 00 00 00 00 ..... 01 00 00 00

Hexview: 0000 0000...... 0001 0000

As above offset 00 and 01 are group together as word. Each group, Least significant bit is on right. So 0001 shown in hexview group as word and same to we want 0001 0000 in dword as 00000001.

So 0x1, as byte 01 00 00 00, as short 0001 0000, as dword 00000001

Hope above helps your way to go further.

(Updated 20191024)

Please refer to top post step i, might missed above step, please do try "fastboot oem unlock" and see if needed to fully unlock the phone. I am not sure, it is too long ago to me.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
I didn't understand any of these things about HxD and then in the video you don't see that you edit this file, look at what it gives me while I try to boot. If I send you the file, please edit it for me?
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
So, I modified the FRP file and I hope I did well now I send you the screens, after the flash of this FRP, doing fastboot oem unlock and fastboot boot boot-sign (only for test) gives me these:

Microsoft Windows [Versione 10.0.18362.418]
(c) 2019 Microsoft Corporation. Tutti i diritti sono riservati.

D:\adb>fastboot oem unlock
FAILED (remote: 'unknown command')
fastboot: error: Command failed

D:\adb>fastboot boot boot-sign.img
creating boot image...
creating boot image - 8757248 bytes
Sending 'boot.img' (8552 KB) OKAY [ 0.826s]
Booting FAILED (remote: 'unknown command')
fastboot: error: Command failed

D:\adb>
[Meizu M3 Note Guides, News, & Discussion] 99degree:
A bit strange, seemed like the lk does not support "oem unlock" and "boot" cmd like the one m3note intl lk version does. please take a look on https://youtu.be/Gsn8FynWxaU video and see if it give you some insight.

all the best.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
I saw the video, it's a very interesting thing ...

Now I put the screen to show you what comes to me when I go to HxD. It says that the oem unlock is false, isn't there a way to change it and make it true? maybe doing this I can activate the bootloader unlock.

Do you have telegram? if you can write me your@ in private so it's more comfortable.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
P.S: I saw the other video and I realized that I was wrong to edit the FRP file.
[Meizu M3 Note Guides, News, & Discussion] 99degree:
Thx for watching. if your search result shows that is the only place of "oem unlock" then sorry i wont have further advice. if your search shows further (either) "oem unlock", "oem-unlock", "oem bootloader-unlock" kind of pattern is available, then you might have chance to go further. aside, you might worth to have a try to download as many as possible for different version (intl, chn, beta as well) of rom of your phone and do the search to all lk.bin, then see if there is any early version have this fastboot cmd.

PS 1, if you wanted to see if there is any optimized logic of the bootloader-boot-chain, then you better go through the source code (or the one similar to your phone).

one of source of info https://github.com/mbskykill/m3note_android_bootable

PS 2, A side note, your frp image is a bit strange and seem not holding real data. FYI frp is mainly used by google/android for its activation and phone lock etc. so wipe it sometimes overcome the "lost password" issue ;) thats why the key to the solution must written to the last dword to avoid frp content overwrite.

all the best.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
For the m5c the lk, they are the same and do not come out like you. Isn't there a way to add support manually to unlock?
[Meizu M3 Note Guides, News, & Discussion] 99degree:
Sorry gentleman, modify frp is an indirect method, your through is a right direction. i was tried to disassembly the lk linking library, seclib.a, early this year. Due to my limited knowledge, i cant come up with something new.

In case you are interested to continue, you might need to check the seclib.a binary and see how it goes.

Best wish.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
How to exploit with the seclib.a binary?
[Meizu M3 Note Guides, News, & Discussion] 99degree:
here are some ideas, so please dont put it too seriously.

In lk, compiling source and linking to lk.bin involve seclib.a and this is the supporting lib that contain functions for check unlock status. In cmd_boot function (yes this is coresponding to fastboot boot cmd) call into this lib for that check. Code snippet:

void cmd_boot(const char *arg, void *data, unsigned sz)

{

.....

lock_state = get_unlocked_status();

if (0 == lock_state)

{

fastboot_fail("oem unlock is false");

return;

}

So you can see your boot cmd fail most likely here. Before you decide to do so, please do full text search the code and your lk.bin and see if those text pattern is available.

the checking function is most likely inside the seclib.a, to prove it, i tried to grep all the lk code and find nothing about it. and this seclib.a file missing from the source tree, you can find it somewhere on the web. I believe disassembly a static lib is easier to disassemble a bin, at least static lib have sections by sections and gcc tools are more handy than ida. Hint: mt6797 is an somewhat more open source one. You can get something from linaro website or github. It should be less chance to make change as it is a static library.

Another supporting fact is, when doing oem unlock and flash unlock, lk itself must write something to the mtd(nand chip) to remember the status. Then every bootstrarp, get_unlocked_status can read the status. That should be similar logic to boot from nand chip for reference. So the frp last dword is the permit for manual unlock, and seclib.a is the gatekeeper and check for every boot.

Hope the above can give you some insight.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
Yes but I have to procure the seclib for my preloader that is mt6767, and then handling the preloader is dangerous, if the brick, my device could no longer be started in any way!

P.S:And then it would be difficult to disassemble the preloader, modify the seclib and then reassemble it.

P.S 2: However for me this thing is very difficult, but if LK is able to change the status of unlocking the bootloader, why not modify it by adding the command of the oem unlock and unlock it like this.
[Meizu M3 Note Guides, News, & Discussion] 99degree:
Gentleman, i think you are over-engineered. To disassembly the seclib.a is to get more info about the unlock logic and the condition of unlock, such as where does the oem unlock cmd write to, what value it does write to which partition; or another way, which condition should meet when cmd_boot need; and see if able apply to your phone. Let me raise for example, like the write 1 to frp the last dword, this is exploits should do. I dont think patching the preloader or bootloader is a way to go. They are digitally signed; unlike frp partition, google app and android write to it so it is not digitally signed thus safe to do modification. Of course the rule of thumb is not make any risk on physical damage the phone. Hope this is useful for your further reference.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
No, I don't even know how to disassemble and where to start
[Meizu M3 Note Guides, News, & Discussion] 99degree:
I know that feel. I disassembly seclib.a long ago but i cant find a tool to decompile the assembly to human readable pesudo source code thus stuck there. Later on i searched the internet in a long time and luckly found github repository of m3 note lk code, finally know the trick of frp mod.

If you are in the field then i suggest you to take a look for how disassembly armv7 instruction, as security researcher mastered skill; if you are hobbyist like me, then you might see if there are some breakthrough from other researcher later on.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
But I don't have any time and I want to learn how to do these things that will surely be very complex for me, I've already been looking for an exploit for a couple of hours and I didn't find anything, I guess I got bored
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
However, I was thinking that there is a way to unlock the bootloader, that is, to change the DevInfo partition, I heard that it is written if it is unlocked or not.
[Meizu M3 Note Guides, News, & Discussion] 99degree:
highly likely in another partition, i got a bit of time and get a glimpse to the mt6755 lk code, seccfg partition is the one for the bit check.

in mt_boot.c,

boot_linux_from_storage->mboot_android_load_bootimg_hdr("boot", CFG_BOOTIMG_LOAD_ADDR);

and then

ret = mboot_android_load_bootimg("boot", kimg_load_addr);

thus fill up g_boot_hdr struct, then if not null and then call into boot_linux() and return atf.

thus mboot_android_load_bootimg() in load_image.c does also verify the security too.

policy_entry_idx = get_policy_entry_idx("boot");
img_auth_required = get_vfy_policy(policy_entry_idx);

and in get_policy_entry_idx()

g_policy_map is holding the array, this link[1] stored the status. anyway, if you are interested to digg into, you can follow this path.

Hope this helps, i need to fight for my bread and butter now and will stop here. Good luck.

url 1:https://github.com/mbskykill/m3note...er/bootloader/lk/platform/mt6755/sec_policy.c
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
However I found out that in reality seccfg has the unlock status of the mediatek bootloader, perfect but there is a problem, how do you modify this partition?
[Meizu M3 Note Guides, News, & Discussion] januxool:
I cannot enter the recovery mode to install update.zip for

(6.3.0.3A) or not even reset the factory, it shows the logo 2 times and restarts flyme, in a Russian forum I saw that it could be solved but the google translator does not help.

Read.

Get into recovery mode with these steps.

need original recovery,

flash and without restarting open update.zip from native file browser.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
@99degree Forgive me for the trouble, in the end after a long time I unlocked the bootloader of my device by installing an engineering rom, but I have another problem, I have problems with the rom and to solve them I need the kernel the problem is that my Meizu M5c does not have the public kernel sources and sending an email and asking for them I did not get positive answers. There is a need to decode the LCM of the device but I don't know how to do it on ARM64, do you know a guide or do you have any advice for me?
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
Hi, I tried to look for the model of my lcm but it is nowhere to be found, nothing is found, then I also tried to start a lineage os 14 compiled from source, it was fine but with a prebuilt kernel however it is castrated, I had problems to the camera that probably need to be fixed only with the kernel sources I don't have and in any case the TWRP has been started successfully.
[Meizu M3 Note Guides, News, & Discussion] 99degree:
If you think that the kernel source need to get changed, then 90% you need to find it elsewhere and port those drivers yourself. I have no idea about camera subsys, but essentially this is another mystery puzzle and you might need to find the cmos driver source yourself. Generally people prefer to get vendor blob patched or preloaded shims lib to get it working with newer android system and stick with original binary kernel img. Good luck.
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
The problem is not the shim but it is another one, now I'll put the error:

IspDrv : [vendor/mediatek/proprietary/hardware/mtkcam/legacy/platform/mt6735m/core/drv/isp/isp_drv.cpp, waitIrq, line2251] ERROR: ISP_WAIT_IRQ fail(-1). Clear(1), Type(0), Status(0x00000400), Timeout(5000).
01-19 18:36:56.399 296 1683 E iio/ifunc: [vendor/mediatek/proprietary/hardware/mtkcam/legacy/platform/mt6735m/core/imageio/drv/cam/isp_function.cpp, waitBufReady, line4452] ERROR: waitIrq( irq_TG1_DONE ) fail
01-19 18:36:56.399 296 1683 E iio/pathp1: [vendor/mediatek/proprietary/hardware/mtkcam/legacy/platform/mt6735m/core/imageio/drv/cam/cam_path_pass1.cpp, dequeueBuf, line0234] ERROR: waitBufReady fail
01-19 18:36:56.399 296 1683 E MtkCam/VSSScen: [dequePass1] mpCamIOPipe->dequeOutBuf fail (dequePass1){#1167:vendor/mediatek/proprietary/hardware/mtkcam/legacy/platform/mt6735m/core/hwscenario/VSSScenario.cpp}
[Meizu M3 Note Guides, News, & Discussion] 99degree:
No idea, out of my knowledge. Sorry. You might try to replace the camera binary with the original rom provided. (propritary) kernel API are often change (android/soc) version by version. At least old kernel should work with old camera HAL binary. Replace JNI layer jar file if needed.

my 2 cents
[Meizu M3 Note Guides, News, & Discussion] XRed_CubeX:
Hi, a friend of mine has m3 note l681h, he tried to flash the android nougat beta bootloader manually with sp flash tool but he found the device in brick, is there any possibility of recovering? Does flashing the beta correctly with update.zip risk hardware damage to the device?
[Tilt, TyTN II, MDA Vario III General] albarrios:
Has anyone had any luck enabling this feature on the Kaiser and have it work?
[Tilt, TyTN II, MDA Vario III General] dampeal:
Kaiser Tweak will do it for you
[Tilt, TyTN II, MDA Vario III General] XtreMe_G:
yup, no problem
[Tilt, TyTN II, MDA Vario III General] albarrios:
Really? Cool!!! Will try it.Thx!!!
[Tilt, TyTN II, MDA Vario III General] albarrios:
Hey, it really works, thx again. Has anyone worked with this? Where is the actual GPS information stored? Can it be displayed like the time stamp?
[Tilt, TyTN II, MDA Vario III General] AthenaLod:
GPS coords will be incoded within the picture file... some softwares like picasa can extract it, and i think some can post gps pix to maps showing their location.
[Tilt, TyTN II, MDA Vario III General] albarrios:
OK. Cool, you are right, Picasa has that ability, but it does not seem to work. Here is the information from Picasa.

Photo 4 of 4

PPC

May 28, 2008

1600×1200 pixels – 246KB

Filename: GPS_003.jpg

Camera: HTC

Model: HTC_TyTN_II

ISO: n/a

Exposure: n/a

Aperture: n/a

Focal Length: n/a

Flash Used: n/a

Latitude: n/a

Longitude: n/a
[Tilt, TyTN II, MDA Vario III General] gwnorth:
Go download Opanda exif viewer - it is a full exif viewer (there are lots of other freeware ones as well).

http://www.opanda.com/en/iexif/
[Tilt, TyTN II, MDA Vario III General] albarrios:
That works. Thx! Would be nice if it could post it on the pic like the time stamp.
[Android Software/Hacking General [Developers Only]] 0xA:
Preparation:

1. A memory card

2. One computer, and the spreadtrum driver has been installed (how to determine whether the driver has been installed, in fastboot mode to see whether there are unrecognized devices in the device manager can be).

3. The phone is in debugging mode

Start work:

1. Download duoqin1splus. rar, extract the duoqin1splus. rar and copy updata.zip to the local directory for backup;

2. Connect the phone to the computer (make sure there is a memory card inside!), uncompress DuoQin1SPlusRecovery. Rar, run runme.bat;

3. The phone will automatically enter fastboot, restart and enter the Recovery mode. Press "8" to enter the main interface of Recovery (don't double clear!Do not double clear!There is no Recovery mode to resume the previous step!;

4. Select "Apply update from external storage." select "update.zip" to copy to the memory card.

5. After the brush is finished, it is forbidden to double clean; select "reboot system" directly;

6. Wait for restart to enter the interface.

If you need to reset the phone, please go into the Settings to restore the factory Settings after the phone starts up normally. I will not be responsible for the repair of the jammed screen caused by double clear. Remind yourself not to listen. It's your own business.

Issues to note:

1. This kind of thing is mostly made out of feelings (yes, mobile phone has been repaired 2 times, and this test will be repaired again).Do not use for commercialization, once found, I will pursue the responsibility of commercial pirates.

2. After starting up each time, the recovery of the mobile phone will be restored to the official recovery. If you have other needs for using the mobile phone, please follow the steps in the beginning work and start over again.

3. Once the system is modified, ota update cannot be installed, please note;

4. Swiping machine is risky, please be careful.

You can read the original at: myworldbooks.cn/archives/683

Download link: pan.baidu.com/s/1d84F1SCgpauisG-6dr1x6w

Code: 74ex

Unpackage code:

George_20190813

------------------------------------------------------------------------------------------------

20190928 update

Flash program & package

Download link: pan.baidu.com/s/19YQiV69j2IPpyi-PL21VuQ Code: 8d7g

Offical Package

Download link: pan.baidu.com/s/1dwotU5e6rsX220plCDGqPA Code: hk7i

All the information which had updated was in the source page: myworldbooks.cn/archives/683
[Android Software/Hacking General [Developers Only]] 0xA:
in addition:

who can provide me fdl1 and fdl2 files of sc9820e? thanks.:)
[Android Software/Hacking General [Developers Only]] yeaster:
can someone help to host the files onto another website? don't have access to baidu

many thanks!
[Android Software/Hacking General [Developers Only]] ikoko:
https://drive.google.com/open?id=1aqz-BmlwImyGeZvnd_9XMyVbwApgoui4
[Android Software/Hacking General [Developers Only]] yeaster:
thank you both! managed to install whatsapp by following the steps!

you guys are great!
[Android Software/Hacking General [Developers Only]] jcbwlsnlee:
I followed the steps in the guide and I am stuck at step 3. On this step

3. The phone will automatically enter fastboot, restart and enter the Recovery mode. Press "8" to enter the main interface of Recovery (don't double clear!Do not double clear!There is no Recovery mode to resume the previous step!;

My phone is entering fastboot, however there are no selection within the fastboot whatsoever. How do I restart and enter Recovery mode?

I tried holding the power button, it restarted but it entered the normal boot.

Tried to restart again and hold 8 still the same.

Can anyone help? I followed all the steps.
[Android Software/Hacking General [Developers Only]] NickTheGreek:
I can confirm it.

Following these steps the phone enters fastboot, but without automating restarting on Recovery mode.

Also on fastboot there no option for manual restart on Revovery mode.

Any help will be welcome.
[Android Software/Hacking General [Developers Only]] gaguga:
Tool for Qin 1s and Qin1s +

Install Qin 1s and Qin1s + Applications

Getting root rights to 1s + version

Backup partitions on 1s + version

Quick reboot commands
[Android Software/Hacking General [Developers Only]] 0xA:
Thanks for your work. it's useful. :good:

I hope you do not mind i had been sharing your programs in my blog.

thank you! :)
[Android Software/Hacking General [Developers Only]] 0xA:
So sorry reply you too late. Your could press the power button when your phone hold on the fastboot mode. If you can't enter in the recovery mode, may be your adb.exe is using or derive of fastboot has some problems. Please check and fix them.

The source page in Chinese and the origin flash programs was updated. it may solve your problems.
[Android Software/Hacking General [Developers Only]] 0xA:
Please check off your drives when your phone is under the fastboot mode, and ensure the adb.exe is not in using.
[Android Software/Hacking General [Developers Only]] NickTheGreek:
Thanks man, It's working now!

---------- Post added at 09:54 AM ---------- Previous post was at 09:47 AM ----------

Also, does anybody know a workaround solution in order to make the OTA updates working again?
[Android Software/Hacking General [Developers Only]] 0xA:
I had updated some new packages to solution the problem about the OTA updated after cracked phone, and you can view the source page to find them.

If your phone version is not in list on the source page, please recover to the recently official system and crack phone again.

By the way, you can make a package to delete the PackageInstaller.odex and put a new PackageInstaller.apk which is download from Google official and the app's file name is not same with the preset PackageInsatller.apk, after that, Using the cracked recovery to install the package, OTA update will be normal and phone could install any application also. (App must support Andriod 4.4.4).
[Android Software/Hacking General [Developers Only]] NickTheGreek:
Thanks!

But i don't have access to baidu.
[Android Software/Hacking General [Developers Only]] ikoko:
0Xa, please, help to recover device! I try method from 29 sep, something rong, now my phone is bootloop. is there any solution for repair!?!

Reload software 1.2.2 and other files on filehost, can't download from Baidu.
[Android Software/Hacking General [Developers Only]] 0xA:
Do not worry. If your phone is under the bootloader (fastboot mode), just long press the button of power, and waiting for device to reboot to the phone desktop. The drive of bootloader (fastboot mode) which has not been installed well may cause that.

And i'm sorry to tell you that the accessibility function is disabled in this phone, so the talkback tool may not be available. but i helped you to feedback this question to DuoQin official support. before official solve it, may be there has another way to solve this problem when the phone has rooted.

I had updated all file in Mega. and you can download it from this url: https://mega.nz/#F!64VV1IQB!k3F1pQCcT3W94fUblPH7eA. Hope it's will help you.
[Android Software/Hacking General [Developers Only]] 0xA:
I had updated all files in Mega, and u can also download from https://mega.nz/#F!64VV1IQB!k3F1pQCcT3W94fUblPH7eA.
[Android Software/Hacking General [Developers Only]] ikoko:
0XA, i can't enter in fastboot mode, my phone is on permanent reboot. How can i enter in fastboot or recovery mode by key combination? please, write me e-mail on Duoqin support!

Thanks and regards.
[Android Software/Hacking General [Developers Only]] hooddy:
[MENTION=10080701]0xA[/MENTION] can ya help me to get root and gapps for Qin2 please?
[Android Software/Hacking General [Developers Only]] Ran0250:
Add more language

Can anyone help me how to add language. The device only supports English and Chinese I need Hebrew language (mainly for typing sms) Is it possible to add additional languages (keyboard) ​​via root access?
[Android Software/Hacking General [Developers Only]] skanskan:
Hello.

Is there any other firmware with more languages?
[Android Software/Hacking General [Developers Only]] Ciuma777:
Please link Download
[Android Software/Hacking General [Developers Only]] Nguyễn Thành Đạt:
Share Link download

Please share download link sofware, Thanks so much!!!!!!!!
[Android Software/Hacking General [Developers Only]] Naftali123456:
Installing an app in XIAOMI QIN 1S +

Installing an app in XIAOMI QIN 1S +

I want to install an app on XIAOMI QIN 1S +

Can anyone explain to me how I do it?

thank you