yashsingh1/xdaforums huggingface dataset:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Why rebranding? With no check I'll be able to flash C55 files. What do you mean when you said enter in usb serial mode? Is there a way to do that without BL unlocked?
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Because once you will be on EMUI 10, the bootloader will be locked again, so with C432 you would have more chances to get OTA updates (if Huawei will still push updates after EMUI10 update).

There were cases when the device went directly to USBserv when bricking it with the xloader2 update, but i don't know if that would still work with an attempt to downgrade from xloader2 to xloader1. That would give you a one shot possibly to use DC-Phoenix without removing the back cover.

That's an option i would consider only if you are ready to open the back cover and use TP.
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Yep I'm not ready for that :o too risky and advanced for me :eek: I'll try to find a method to authorize this stuff, because maybe also HSTool does it changing DNS and stuff like that
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
You won't find a way to authorize these unapproved firmwares, take my advice, just relax and wait for the official OTA.

HStool never worked with unapproved firmwares, tested that long ago, changing DNS won't magically approve a firmware.

No pain, no gain! xD
[Huawei Mate 10  Guides, News, & Discussion] nomone:
If I'll open back cover of my phone then will you help me? I don't want to pay money for something I can do myself, I'm a fiber technician so I'm pretty good at this stuff, just not sure how to open the cover without a plectrum :laugh: but I have a thermal gun to heat it up
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
If you have a thermal gun then it's easy and there are also a few good tutorials on YT.

The key is to be patient while removing it, going one little step at the time. And only use plastic tools (a piece of plastic from an x-ray result would also be fine).

Well, unlocking and other things still require a paid tool, so....
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Uhmmm ok so if I have to pay I will not do this :rolleyes:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
But wait, if for "pay" you mean 4€ with DC-Unlocker I'll do that :eek:
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
No, it's a bit more, about 15€.
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Ohhh it's cheap, I was thinking about something higher than 30€!! So I remove the cover, disconnect battery and shortcircuit testpoint with ground... then? Can you post me the best guide to unlock the bootloader?
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Well, i could put together a guide with the steps i did a few days ago, except i didn't rebranded (but you could do it). I used DC Phoenix + HCU.

Contact me on Telegram!
[Huawei Mate 10  Guides, News, & Discussion] nomone:
You're very kind, but I noticed that I have not the glue to reclose it :crying: so maybe it's better to buy it and wait. And also I have not a sucker... Ventosa si dice così in inglese? :eek:
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
You're going extreme xD
[MENTION=2642882]Pretoriano80[/MENTION] , there is no authentication checking if the person uses dload method right? so shouldn't nomone try that rather than opening his phone and probably ruining its water resistance?

Also nomone you can try system recovery, BUT after download finishes, modify your hosts file, adding 31.7.187.197 query.hicloud.com, this way, authentication request gets blocked and responded by "0", not quite sure, but that might be the way Funkyhuawei installs unapproved firms ( be sure it's system recovery ), maybe not and your phone gonna get bricked :confused:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Yes I was looking also to let the phone to be dual sim, after 20€ charged :angel: but if there's this other option I think I will try. You can use both system recovery or update on FH's method, depending on your emui version and phone

Instructions for 'Incompatible Phones' - EMUI 8 and below phones which have been upgraded to EMUI 9: 1. Follow steps 1 - 3 above 2. Uninstall HiSuite 9.0.2.301 3. Install HiSuite version 5.0.2.301 from here: https://drive.google.com/file/d/1OPeu3s-Np_7uZndVEBkzBZTYC1Bayl14/view 4. Connect your phone to HiSuite normally (not in Fastboot mode) 5. Use the 'Update' function to install firmware via FunkyHuawei.

For compatible phones they tell you to use system recovery

I think dload also has an authentication. Before you released system recovery feature in your tool I tried several times to unbrick but without success, but maybe that authentication is made only for the zip packages and not for fingerprint
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Well, authentication requires connection to network apparently, and if people been able to install a package through dload and just by download it directly from huawei without any further process I guess then dload doesn't check for authentication. However maybe Huawei modifies the uploaded zip package after approval?
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Maybe yes, what you said is right, but I think there's a basic check that dload packages do. For example the first times for me never started to install, then I changed zip names and recovery arrived to 5% and failed. This is to let you see what difference I had simply changing the zip names :o
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
I'm not sure how dload works exactly, but it does sone checks, not like normal FullOTA though.

It definitely checks oeminfo and gets device info from it (region, build number, etc).
[Huawei Mate 10  Guides, News, & Discussion] ante0:
There is no authentication required when you flash a dload package or when you use usbupdate, but it still needs to be a valid package and it's most likely signed by Huawei. So you can't fabricate your own package without signing it, I guess.

It also doesn't auth data or public package (Which I guess would mean cust and preload in 9+).

This is what it says in recovery binary.

It's also what I used when I made NoCheck for Pie, it thinks any package is dload.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Do you think by some low level coding someone could turn a PC into an external storage for phone? :confused:

that way we would not need a nano memory or OTG cable :confused:

pretty smart :mad:
[Huawei Mate 10  Guides, News, & Discussion] ante0:
If you're unlocked you can use /data/update/dload/ ?

A PC can only be host when it comes to USB, but it can be done possibly https://unix.stackexchange.com/a/283147 ?

You could use another phone as client though, but it'd still require an OTG cable.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
If I'm not wrong huawei allowed hisuite to push files into system data folder, I guess through fastboot perhaps, which comes along with hisuite, theoretically we can change the direction into update/dload using same order hisuite gives and probably anticipate the phone to refused the order? ?

I guess I'll try playing around with those in the coming days :silly:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
So can I use dload method with online packages? (Obviously renaming the files)

---------- Post added at 06:24 AM ---------- Previous post was at 06:04 AM ----------

This is what I thought all these days... we see that HiSuite extracts img files from HS ROM folder and pushes them through fastboot.

The problem is that when HiSuite downloads the ROM zip files they become DBK files, maybe something that just HiSuite can read and you can't open with winrar :laugh: so replacing recovery img I think is pretty impossible... if that was possible we could use an approved firmware to authorize everything and push no check recovery

But maybe you can intercept that commands and change the folder? I've seen in a file located in HiSuite's appdata that there is the path which HS takes the downloaded ROMS, changing that is pretty simple, but surely doesn't gonna work :laugh:
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Yup in fact dload is made to install huawei's firms which you can find online from their cloud if I'm not mistaking...
[Huawei Mate 10  Guides, News, & Discussion] nomone:
I guess is needed to install stock roms :o you find them on sites like androidhost or easy-firmware
[Huawei Mate 10  Guides, News, & Discussion] ante0:
You can't use firmware from hicloud as dload. They are Online only. Dload is offline firmware.
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
No, you can't use dload mode with online packages. The nocheck recovery is modified to consider the online firmware as dload so it will skip authorization check, but with the stock recovery you can't t do that, even if you rename the files, it will know it's not a dload package (service firmware), because dload still checks for a valid signature (@ante0 explained that already).

Yesterday i already pushed the nocheck recovery with HiSuite, but it's pushed as rescue_recovery_ramdisk, so it did nothing, installation still failed.

And if you modify the firmware and add nocheck , it will still fail to install because of the integrity check, so there's no way around it.
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Really good :o

So you pushed it manually? How?
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Just replaced recovery_ramdisk after HiSuite finished extracting it to the temporary folder, but like i said, it won't change anything.
[Huawei Mate 10  Guides, News, & Discussion] nomone:
But sorry have you used an approved firmware?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
I'm full desperate now, just gonna wait for Huawei, though lucky enough I got C185 ( Middle East ) variant, and I see Huawei's actually doing some stuff for us.

Middle East CUST

v405068 - Tue, 12 May 2020 02:58:10 GMT
[Huawei Mate 10  Guides, News, & Discussion] nomone:
I think they never gonna approve that unknown firmwares. They will roll out directly a new firm I think... and this could happen late :crying:
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
well, last time I could see China's "smart charge" update a week before it releasing, it was not approved too but later it got approved and rolled out to people...
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Nope, but i doubt that it would change anything. You can try it yourself with the firmware version that you are actually on.
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Ok just explain me how to do this. I download no check recovery and then rename it as you did? But I'm a bit scared of bricking :o

---------- Post added at 08:43 AM ---------- Previous post was at 08:42 AM ----------

And was it named unknown?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Basically no firm is named unknown, the name always exists in "version" file inside the zip package, however if it's not approved yet, the firm's name doesn't appear in the authentication request. also Huawei these days seems to be even too lazy to change the "version" field inside change logs

http://update.dbankcdn.com/TDS/data/files/p3/s15/G5398/g1755/v389209/f1/full/changelog_base.xml

<component name="TCPU" version="请自行修改"/>
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
I already told you how to do it, just check the HiSuite/Rom/your_base_name folder and you will see that it gets extracted to a temporary folder, keep an eye on thst while HiSuite is extracting and replace the recovery_ramdisk after HiSuite is done extracting it.

The "unknown" naming it's a FF thing,it's not a problem for Huawei. xD
[Huawei Mate 10  Guides, News, & Discussion] nomone:
I'm scared of what could happen if I replace that file :crying:
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Then why you asked? :))

However, as i said, I've tried that already and nothing happens. xD
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Simply knowledge :silly:
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Patch

v406838 - Wed, 13 May 2020 02:40:31 GMT

[MENTION=2642882]Pretoriano80[/MENTION] [MENTION=10693703]nomone[/MENTION]

Any idea what's that shiz? :silly:

VERSION.mbn: patch01
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Maybe an incremental update? Bug fixes?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Could be for global beta testers?
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Probably a hot patch.
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Is it approved? If it's a patch I think is risky installing it on 9.1

EDIT: I've seen now that it's only 12,39mb :laugh:
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
no, it's not approved yet, yup should not try it, it's for EMUI 10
[Huawei Mate 10  Guides, News, & Discussion] nomone:
12mb :laugh: :laugh:
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Base

v407123 - Thu, 07 May 2020 05:14:52 GMT

Japan Preload

v407122 - Thu, 07 May 2020 04:10:32 GMT

Japan CUST

v407124 - Thu, 07 May 2020 04:03:36 GMT
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Plus, it just got removed from Huawei servers :eek:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Too much time... I'm bored
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
[MENTION=2642882]Pretoriano80[/MENTION]

Apparently authentication request in fact does not sign the package but the base64 string which gets returned as a response, which in fact contains:

Firm status (0=approved,1,2) and versionNumber (firm's named)

Because whenever I manipulated the base64 or the sign, hisuite refused the update.

Apparently the base64 response is being signed by RSA, and the "sign" is the returned signature.

The question is, do those data get passed to android and being used in package verification process? or HISuite reads the base64, if it's valid, does some changes to the package saying it's valid rather than passing the same http request's response to the android phone?

I've found only one usage of the function "RSA_verify_PKCS1_PSS" in HISuite's reversed codes, shall I try manipulating that to return true always? :confused:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
I think in the meantime you should proceed, then if you don't succeed see what Pretoriano says. But please proceed mr robot :laugh:
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
AFAIK HiSuite pushes at least one auth key to the device when the firmware is also transferred.

The path should be /data/update/HWOUC/updateauth/authorization_file
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
I see, also it's saying that request is grabbing the authentication file. "GetAuthFile"

[2020-05-13 18:41:21:578][L2_VIM][fn=14][RESULT: FALSE][HiSuite_SystemUpdate][[[CAUSE: ERROR_CODE=0]]][[[DATA1: GetAuthFile file=......[tid=7292]]]][[[DATA2: T]]][[[DATA3: T]]]

:/ so.... apparently we can't really do anything to bypass that, unless we're insiders like funkyhuawei :p:silly:

BUT, System recovery method doesn't send that authentication file over to the phone? :p:D

if we let HISuite bypass the RSA verification, then that might work? :highfive:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Go ahead mate, you're near :laugh: tell me if I can help
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
I guess I'll just fail cuz perhaps huawei has already thought of all that ?
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Which tool do you use to do reverse engineering?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
https://www.hex-rays.com/products/ida/
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Seems to be very accurate! And what about reassembly? Does it?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
You have to modify the codes from hex section I guess (at least that's what I did before)
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
[MENTION=2642882]Pretoriano80[/MENTION]

Any comment?

The code I had to manipulate:

if ( Concurrency::details::_CancellationTokenRegistration::_GetToken(v86) )
{
LOBYTE(v88) = 1;
sub_4B0040(&v84);
LOBYTE(v88) = 0;
sub_48AEE0(&v85);
v88 = -1;
sub_4B0040(&a2);
result = 1;
}
else
{
v52 = Concurrency::details::_CancellationTokenRegistration::_GetToken(v83);
v51 = L"UpdateAuthorizationCheck ret = %d.";
v50 = 0;
v73 = &v43;
v15 = sub_4D2E90(L"HiSuite_SystemUpdate");
v56 = v15;
v55 = v15;
LOBYTE(v88) = 9;
v42 = 8;
v74 = &v35;
v54 = sub_4D2E90(L"HiSuite_SystemUpdate");
v53 = CLog::GetLog();
LOBYTE(v88) = 2;
CLog::Failure_Format(v53);
v72 = 0;
LOBYTE(v88) = 1;
sub_4B0040(&v84);
LOBYTE(v88) = 0;
sub_48AEE0(&v85);
v88 = -1;
sub_4B0040(&a2);
result = v72;
}

The if - else statements were vice versa:

if ( Concurrency::details::_CancellationTokenRegistration::_GetToken(v86) )
{
v52 = Concurrency::details::_CancellationTokenRegistration::_GetToken(v83);
v51 = L"UpdateAuthorizationCheck ret = %d.";
v50 = 0;
v73 = &v43;
v15 = sub_4D2E90(L"HiSuite_SystemUpdate");
v56 = v15;
v55 = v15;
LOBYTE(v88) = 9;
v42 = 8;
v74 = &v35;
v54 = sub_4D2E90(L"HiSuite_SystemUpdate");
v53 = CLog::GetLog();
LOBYTE(v88) = 2;
CLog::Failure_Format(v53);
v72 = 0;
LOBYTE(v88) = 1;
sub_4B0040(&v84);
LOBYTE(v88) = 0;
sub_48AEE0(&v85);
v88 = -1;
sub_4B0040(&a2);
result = v72;
}
else
{
LOBYTE(v88) = 1;
sub_4B0040(&v84);
LOBYTE(v88) = 0;
sub_48AEE0(&v85);
v88 = -1;
sub_4B0040(&a2);
result = 1;
}
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
I can test it, that's no problem! You already pushed the new version to GitHub?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Not yet because I did the reverse engineering manually now I have to implement it in the application :cowboy:

and also I have to do a few changes to let versionNumber get appended into the authentication file too, got a few things to do now, hopefully gonna publish that update tonight :D
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
You meant that to be used with VersionID spoofing and make it push the authorization key from an approved firmware?
[Huawei Mate 10  Guides, News, & Discussion] nomone:
I always told you are a guru!! This is revolution :o
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
But this might or might not brick your device, so you can't use it. :))

P. S Was not confirmed working, yet!
[Huawei Mate 10  Guides, News, & Discussion] nomone:
I think this could brick only if the firmware is not okay. Maybe Huawei doesn't approve them because of bugs or something else... with this method we're just bypassing auth check, so why bricking? :eek:
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
You know the xloader2 story? Well, not everything that's on hicloud it's safe, so there's always a risk.

However, i was just teasing you! :P
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Yes in fact this is what I said. We'll never know if an unapproved firmware is good, but this method "simply" manipulates the authentication, so if you brick I guess is firmware fault, not [MENTION=8477970]IProfessor[/MENTION] one...

P.S. so VersionId is very important! You got it a long time ago :angel:
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
I never implied that it would be someone's fault, but that you will still be afraid to flash it! (aka teasing you) xD
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Yes I know :laugh: :laugh: you're right, I'll be afraid, but you can try it before me :laugh:

You'll be the famous guinea pig, but conscious because of your testing device :angel:

If I brick I'm screwed, not you

---------- Post added at 11:19 AM ---------- Previous post was at 11:16 AM ----------

Anyway, you tried OVS 10.0.0.158 and it worked well as you said, the only difference is TIM cust and preload that I'm scared of
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
No I meant like unapproved firms:

1. Have status value above 0

2. Do not have versionNumber

So I made the app replace status 1 and status 2 with status 0 and append versionNumber with the firm name you choose in the app.

I've replaced Install HISuite button with "HISuite Patch" And donate one to "Install HiSuite"

https://github.com/ProfessorJTJ/HISuite-Proxy/releases/tag/1.8
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Ok, let's try it then.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
btw if it says hisuite is already patched while it's not, be sure you're on version 10.0.0.510_OVE, I'll add support for latest version (10.0.1.100_OVE) asap
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Oh, that's why. I'm on the latest version.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Hopefully this gonna do the trick

https://github.com/ProfessorJTJ/HIS.../HiSutie.Proxy.-.Supported.Latest.HISuite.zip
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
I rolled back to the previous Hisuite, so no problem.
[Huawei Mate 10  Guides, News, & Discussion] vandal4e:
verifications fails on phone so nothing changed for L29C432
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
tried with system recovery too?

Also did you put proper firm names ( copying them from "Version" file of the zip packages? )
[Huawei Mate 10  Guides, News, & Discussion] vandal4e:
how do i try the things you suggested? i tried on default like the screenshot of the latest release, about the proper firm names, do you mean setting 386379, 70, 73 as custom versionIDs in advanced?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
by firm names I meant, like base BLA-LGRP2-OVS 10.0.0.158 and such, system recovery:

https://github.com/ProfessorJTJ/HISuite-Proxy/wiki/System-Recovery-Rom-Instruction-(-Soft-Bricked-)
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
But in his case, the default ones should work out of the box. At least that's how i see it.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Yeah, as their names are properly set however it might really be HISuite pushes the authentication file in normal update, though not sure if that happens in system recovery, because as I can recall, last time HISuite was sending the authentication request one by one for each firm of base, preload and cust unlike normal Update in which all the authentications get embed into one, my assumption is that System Recovery's authentication is apparently different, if we could fool hisuite to think that's approved(as we did now), perhaps it will just proceed then?
[Huawei Mate 10  Guides, News, & Discussion] nomone:
So if I would try, I copy mi links and rename them correctly, then use customversionid and patched hisuite and should work?
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
We will see, it's decompressing now.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
You don't have to rename or use custom version ids actually you just have to open the patched hisuite and try system recovery method
[Huawei Mate 10  Guides, News, & Discussion] Pretoriano80:
Well, System Recovery failed, so no dice. It's not approving the firmware.
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
Jeez :/

Imma head back to my homework, cya :crying::mad::svetius:
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Only recovery, update will fail?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
According to tests and feed backs both fail, you're free to test though. :/
[Huawei Mate 10  Guides, News, & Discussion] nomone:
In your opinion why does it fail?
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
perhaps the authentication is being done inside the phone
[Huawei Mate 10  Guides, News, & Discussion] nomone:
Tried several times and it returns the error 'Unable to update'. Tried also recovery and 'Recovery failed'.

With the update method the phone doesn't reboot and HiSuite returns that error before proceding install
[Huawei Mate 10  Guides, News, & Discussion] IProfessor:
did you patch hisuite, close main hisuite and open the patched hisuite before trying the update?