yashsingh1/xdaforums huggingface dataset:
[OPPO Find X2 Pro Guides, News, & Discussion] user_ScoTTT:
不错，只不过我在最后还增加了一个步骤：fastboot flash vbmeta 似乎关掉开机验证 是有必要的，否则无法成功开机，不知道你是不是也遇到了这样的问题？

[MOD EDIT] Automated translation:

---------- Post added at 09:38 PM ---------- Previous post was at 09:34 PM ----------

我的英语水平有限，对此我感到很抱歉，不过通过谷歌翻译我相信你能理解我的意思:cyclops:

[MOD EDIT] Automated translation:
[OPPO Find X2 Pro Guides, News, & Discussion] user_ScoTTT:
在哔哩哔哩看到你制作的视频教程了，感谢你分享的资源，全局120hz是我想要的:good:

[MOD EDIT] Automated translation:
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
wow! great news! so all magisk functionality works?

any luck with TWRP?
[OPPO Find X2 Pro Guides, News, & Discussion] ytdttj:
Nope. Magisk Hide will break the fingerprint unlock. And OPPO didn't release the source code yet. So TWRP may takes a while.
[OPPO Find X2 Pro Guides, News, & Discussion] user_ScoTTT:
Fingerprint unlocking and fingerprint payment problems can be solved by flashing the magisk module
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Let's together push oppo support!

Friends, I have spoken with oppo sales representative who has sold me my Oppo Find X2 global

, and asked him to request the bootloader unlock option for Global phones which is already available for Chinese version, he has done it and also recommended to contact the support by official means, both email, phone and chat for them to see the demand for this request.

Let's all together request them to make the deep testing app available for our our phones!

Go to support.oppo.com/uk/ (select your country) and call them/write email to support.TWO_LETTER_COUNTRY_CODE(AT)oppo.com

When giving support a call insist to register your request and demand an official answer to your email(they will say that they don't support unlocking bootloaders)
[OPPO Find X2 Pro Guides, News, & Discussion] speedyjay:
That depth test app is bollocks! It says my phone is a carrier customised phone when I've just checked, and it's SIM unlocked....
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
[MENTION=11051671]OppoFindX2[/MENTION] sorry for the super late reply! This is indeed an interesting find.

To sum it up for everyone basically we can learn a few things from this:

1. The actual app responsible for unlocking the phone has the package name "android.engineer.OppoEngineerManager" (probably located under system/priv-app so we can't access it without root ironically)

2. This app gets invoked (as in started at a specified point) with "fastbootUnlock" with parameter var6. So far, so easy.

3. var6 is a byte array which can either be null, a 0 length byte array or a byte array of half the length of var0

4. the third case is interesting since we have a hex value if my Java knowledge is on point here. This means the following:

4.a. var6 is only dependent on var0 and gets filled with substrings from 0 to 2, 1 to 3, 4 to 6, 6 to 8, 8 to 10 and so on, depending on var0's length

5. If we find out where var0 is coming from and what it's value is, we could in theory use

var4 = (Boolean)Class.forName("android.engineer.OppoEngineerManager").getMethod("fastbootUnlock", byte[].class, Integer.TYPE).invoke((Object)null, modifiedVar0, modifiedVar0.length);

to get to the next step of unlocking. What has me curious is actually how they implemented the 1 month wait and how we could work around that
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
nice work mate. We really need a dev here! :)
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Happy if I can be of help :) I did some further digging and found out a few more things:

The string seems to be the public key to the verified boot signing key which means it won't be easy to find out, especially since it's not guaranteed to be true without having the actual apk source at hand. However having this key would allow us to instantly unlock fastboot/the bootloader and bypass avb if my assumption is correct. There's a few options here but I'm not really into the android scene that much so I can't say what the best one would be:

1. A rooted user could get the private key off the phone easily probably. Not sure how though.

2. Google. My previous phone vendor was so nice as to use the same public key for all their phones. If we're lucky and find some .pem file (I think that's the one we need) then emulating the unlock should be easy

3. Reversing the oppo api, this is tedious and takes a lot of time. Basically every action in the unlocker app triggers a request to oppo's servers asking for the current unlock state. There's a few parameters involved though so getting a valid response from that api would need some mitm or sniffing approach

I'll take a more detailed look at it this weekend and see what I can find, then update this accordingly. Some information now might be wrong since it's been a while I was involved with all things Android
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
you are getting my hopes up :) I hope some of the users who already have root can take a look around for any files you may need.
[OPPO Find X2 Pro Guides, News, & Discussion] Pieter-Jan:
So, I have a Chinese phone, and recently got approved for the depth testing. I am not at all a good programmer or any sort, so I hope we/you find a solution soon!

In the mean time, if anyone who has got a lot of knowledge about the subject wants to experiment, but does not have access to a depth testing approved phone, I am open to some sort of a trade :)
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Short update: I started reversing the apk some more but I'm not yet sure what's going on when. The only thing I'm quite sure of is that the app receives some kind of "unlock code" from Oppo's servers (OnePlus apparently did/does the same) and based on that decides what to unlock and what to leave up for later.

What would be extremely helpful is if someone with an unlocked device could spin up a modified mitm version of the depth-testing apk and intercept some traffic before starting the app

I've actually never done this on Android either, but https://github.com/shroudedcode/apk-mitm should get you started.

As for the proxy, I think this https://docs.mitmproxy.org/stable/ is the best bet we have but you can use your favorite tool basically.

Once the proxy is started and the modified apk is installed instead of the real one you should visit http://mitm.it on the device the proxy is running on (or your phone)

Then it should be as simple as downloading some logs and sending them to me privately (please don't post them here as there might be sensitive data sent as well)

I'll try setting up my device for that as well tomorrow. Since my old phone is actually dying for real, I have no choice but to try my luck on the Find X2 Pro now.
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Great findings! Do you have any news? You wrote you will try to setup your own device for interception, do you have an unlocked Chinese version, or another model?

I think that the time check is performed on the server, to issue the unlock key, the main question whether the actual unlock is triggered by a simple command to

android.engineer.OppoEngineerManager or it requires a key which it validates itself, in the latter case we need to extract this OppoEngineerManager from a rooted phone and reverse it to get the unlock code which could be compiled to own crafted apk. I hope that it is not being erased during the unlock process.
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Peter, could you try sending an unlock request again lintercepting it like [MENTION=7935868]curtisy[/MENTION] described?

[MENTION=7935868]curtisy[/MENTION] we could try to modify the deeptesting app to spoof the model of the phone, so the server would think its a Chinese version and allow unlock.
[OPPO Find X2 Pro Guides, News, & Discussion] Pieter-Jan:
Ill do my best :)
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
I did try it just now, both using Charles and mitmproxy. Repacking the app using the apk tool I posted doesn't work unfortunately though and since Android prevents us from having a trusted root certificate for sniffing, I didn't get access to the network traffic at all.

To allow for this, someone with root would have to additionally follow this answer on stackoverflow: https://stackoverflow.com/a/61637667/11062869

Might as well be easier to grab the OppoEngineerManager apk and try to reverse that if someone already has root.

I have a PDEM30 (Chinese version) by the way, with my unlock due on November 1st now. I'll try to tamper with it some more to see if I can somehow get a bit of traffic back at least
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Thanks! Could you extract OppoEngineerManager. apk?

---------- Post added at 08:22 AM ---------- Previous post was at 08:12 AM ----------

Can you try repacking the deeptesting apk with added network security config?

https://developer.android.com/training/articles/security-config

<network-security-config>
<base-config>
<trust-anchors>
<!-- Trust preinstalled CAs -->
<certificates src="system" />
<!-- Additionally trust user added CAs -->
<certificates src="user" />
</trust-anchors>
</base-config>
</network-security-config>
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
apk-mitm already does that (https://github.com/shroudedcode/apk-mitm/blob/master/src/tasks/modify-netsec-config.ts#L6) but it's still a good idea to try manually without all the other things going on there

What happens when I try installing the repacked apk is that I get an error "an app with the same signature has already been installed" not sure what is causing this as the original deeptesting apk is not installed at this point. Maybe you have some idea on how to circumvent it?

EDIT: adb gives me some more detailed error when I disable bytecode verification: INSTALL_FAILED_SHARED_USER_INCOMPATIBLE

EDIT2: Starting to believe it's a system app? At least when decompiling I get the shared user "android.uid.system" not sure how to go about that since simply removing it doesn't seem to work.. So someone with a rooted device really needs to step in and get some logs from the deeptesting apk or pull the EngineerManager from their device
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
You guys are awesome.
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
For guidance on how to pull the OppoEngineerManager to your computer, do something like this (you should have adb installed)

adb shell pm path android.engineer.OppoEngineerManager

This will give you a location of the apk. For example it could be /system/app/OppoEngineerManager/OppoEngineerManager.apk

adb pull path/of/the/apk /where/you/want/to/save/it

i.e

adb pull /system/app/OppoEngineerManager/OppoEngineerManager.apk /home/curtisy/OppoEngineerManager.apk
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Can you share your modded apk? I will check if it's installable on my device.
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Sure thing. I tried using apk-mitm with --wait to remove the shareduserid setting in AndroidManifest.xml as well as objection to try analyzing the app with Frida. Both give the same error but if you want, you can try installing and modifying it some more ;)

https://drive.google.com/drive/folders/1WlBGlrD-YhplvdkR7t3UYmha_X1WgyGj?usp=sharing
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
I have tried to clone eitg Lucky patcher and install, it says installing, no error occurs but it is not installed https://gofile.io/d/XhiQTg

---------- Post added at 04:12 PM ---------- Previous post was at 04:06 PM ----------

Great progress, how do you think, if modify code to spoof the model name and ota version with values from chinese phone, would it be installable?
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Yes and no. I can't tell what would happen but you could definitely try. Although I doubt that's their only protection mechanism but you never know until you try ;)

I'll first focus on getting the key header that's needed to get valid non-null responses. After that, reconstructing a request should be possible.

As an example request with curl, this actually already returns a 200 which is not bad

curl -X POST https://ilk.apps.coloros.com/api/v2/apply-unlock \
-H 'model: PDEM30' \
-H 'key: oppo' \
-H 'otaVersion: PDEM30_11_A.17' \
-d '{
"username": "your.oppo.login@email.com"
}'
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Short update again :) I implemented a small debug app over the last few days to see if I could decrypt the key used for communicating with OPPO API. Since OPPO's server always returns a valid response even when the key is definitely invalid (see the example with key "oppo" above) it's hard to tell if I actually managed to decrypt it. However the key looks like a key at least :p

The next step is constructing a request that is indeed valid by sending sample requests to their server using the reversed apk as a starting point. Probably I'll need about a week with this again since work is keeping me busy during the week so I have limited time on hand (and by far, I'm also not a java expert)
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
Thanks for the update!
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Weekly log #3

I know why it's a system app now :p it's using system permissions so I had to manually map most of the information like IMEI or product ID for now. Luckily so far there is only one thing I need to brute-force and that's a number (means it's easier since there's a potentially fixed number of possibilities).

The only piece I'm missing now is a valid API token which turns out to be the biggest pain. I'm in the process of rewriting the heytap services because OPPO isn't providing any packages for this and I need to access those services to get a valid token.. most of these services didn't properly decompile either, so I am mostly reconstructing smali code now. Might be another week or two before I have a minimal version running but I'll try to post weekly updates.

And of course if anyone is interested in helping to reverse engineer and rewrite the heytap code, feel free to message me! The code is a big mess right now but if there's interest, I'll upload it somewhere privately and share the link to the repo.
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
i'd love to help though i dont know what smali is! :D though ill be ready as a beta tester if you like!
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Admittedly that was a pretty techy writeup haha basically smali is some kind of intermediate code that is most widely used to decompile and recompile an apk. However it's not like the java/kotlin code I posted before and needs to be manually rewritten line by line (that's mostly the reason why the current code looks so horrible :silly: ) in the end, it's like writing a program in a program. You first understand what the smali code does and then try to write the same in code the java compiler actually understands so that it can be turned into another apk.

Beta testing would at the moment require you to manually build your own app (once a releasable version is ready) since I don't have access to crucial information needed by the app, like IMEI, Model/Version number and your api key. But I'll do a writeup as soon as I get a working version so you can all test it
[OPPO Find X2 Pro Guides, News, & Discussion] mishgan:
please tell me which module is needed?
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
[MENTION=7935868]curtisy[/MENTION] thank you for your great efforts!

Can you please share your progress and what are the current challenges?
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Sorry for not posting a weekly update last week. Work and some personal stuff kept me busy so I couldn't work on this as much as I wanted to.

However I opened a GitHub repository now so you can all contribute or track the progress if you want.

You can find it here: https://github.com/curtisy1/OppoUnlocker/tree/master

EDIT: Current challenges stayed mostly the same. I'm rewriting the heytap authentication logic currently to get the last missing piece, the api auth token,
[OPPO Find X2 Pro Guides, News, & Discussion] klanbo78:
It's good to know you're still working on it, I already have an unlocked bootloader but thinking this might be useful for my next Oppo phone ?

By the way, had anyone tried the depth testing app on Android 11 beta, it won't even open for me now?
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
You have chinese version?
[OPPO Find X2 Pro Guides, News, & Discussion] klanbo78:
Yep!
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Hi [MENTION=7935868]curtisy[/MENTION], maybe you have an update?
[OPPO Find X2 Pro Guides, News, & Discussion] bladesss:
Any updates?
[OPPO Find X2 Pro Guides, News, & Discussion] ub4rz4ch:
I have a findx2 pro but in the UK I really would like to root it and or install a custom ROM. I didn't think about the possibility before buying a new phone and now I'm worried it might not be possible. But does this mean there may be hope for me ?
[OPPO Find X2 Pro Guides, News, & Discussion] Stan464:
Hi Ub4rz.

Sadly, it doesn't look very good. Also from the UK. Using what they call a "Carrier Customized Phone" meaning they won't allow me to Root.

So, someone has been trying to reverse engineer the Rooting Process via their special app but it doesn't look hopeful really.

It's not the the application that's the issue, it's the API they use...

Tl:Dr: no current method unless using Chinese or Unbranded/Carrier, all in all, you are in the same boat as the rest of us..
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Again, I apologize for the late reply and lack of updates. I've been busy with a bunch of other projects both private (for instance, my phone number landed on some scam list, so I had to work on a call blocker for my router) and work related so I haven't had any time at hand to continue the reversing process. However there shouldn't be much left to do. Just one function call to the MainActivity.

There is an issue with this though: If I finish this to a usable state, I need testers with a rooted phone to send me their results. It might even be a useless effort because I can't be sure what the Oppo API returns. I'll try my best to work out the rest of it this weekend, so maybe people could get some new insights
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
On a sidenote, if anyone here is more knowledgeable than me about device dumps, is this of any use?

Files · qssi-user-11-RKQ1.200507.003-1584699103-release-keys · Android Dumps / Oppo / op4a7a

git.rip

git.rip
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
There is another issue, I have updated my phone to coloros 11, and the deeptesting app does not run anymore. It looks like there is no new version on chinese bbs.
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
That's actually good to know. I was worried mine was broken because of missing apps I uninstalled through adb but I guess Oppo themselves didn't really test their own app much before updating :ROFLMAO:

Is there anyone here with Android development experience? I'm currently looking at Oppo's IEngineer.java and am wondering where the transaction goes here

public boolean saveEngineerData(int type, ArrayList<Byte> engineerData, int length) throws RemoteException {
HwParcel _hidl_request = new HwParcel();
_hidl_request.writeInterfaceToken(IEngineer.kInterfaceName);
_hidl_request.writeInt32(type);
_hidl_request.writeInt8Vector(engineerData);
_hidl_request.writeInt32(length);
HwParcel _hidl_reply = new HwParcel();
try {
this.mRemote.transact(1, _hidl_request, _hidl_reply, 0);
_hidl_reply.verifySuccess();
_hidl_request.releaseTemporaryStorage();
return _hidl_reply.readBool();
} finally {
_hidl_reply.release();
}
}

this.mRemote is an interface of type IHwBinder. I'm not too familiar with all the Proxy stuff but my guess is that it goes to some service? This is pretty much the missing link between what happens on the phone and what is returned from the API but my knowledge is too limited to know what exactly this does
[OPPO Find X2 Pro Guides, News, & Discussion] Sage:
Still watching the thread with interest! And hope!
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Can anyone try getting into engineer mode by dialing *#*#2674424#*#* on their phone? It's not working for me but I'm not sure if I just modified too much already :oops:
[OPPO Find X2 Pro Guides, News, & Discussion] MeTheRebel:
Engineer mode is *#808# afaik
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Hmm both don't work for me so probably something is broken on my end.

For reference, I've been trying to find the missing link from my previous post by looking through some system apps in jadx and there's one called com.oppo.engineermode that has the aforementioned number as action for the dialer. Would be interesting to know what this does and whether there's a difference
[OPPO Find X2 Pro Guides, News, & Discussion] MeTheRebel:
I found *#36446337# works as one of the engineering modes. If it doesn't work for you I think you need to unlock it using sec5.exe method. (I used *#9434# and not the USB)
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
Both don't work for me on an unmodified system, first one just exits the dialer, second one calls USSD.
[OPPO Find X2 Pro Guides, News, & Discussion] OppoFindX2:
*#9434# shows this menu:
[OPPO Find X2 Pro Guides, News, & Discussion] MeTheRebel:
Ok gotcha, you have to use authtokendecrypt with sec5.exe to access these menus
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Sometimes I wonder why they'd put about 4 different keys that trigger an "engineermode" event into their system where only a handful of them work and then I remember how the code they use for their apps isn't even obfuscated. From a software developer point of view it's pretty funny to be honest but also makes finding a place to look into harder.

I still have around 10 interesting apps on my list that sound interesting. Currently the postmanservice seems to handle some kind of communication from the depth testing app but I'm still not too into the code to understand it fully. Hopefully I can do some kind of write-up soon and might find something that would actually help people out.

For reference, I created a new branch that is pretty much my current playground. An empty app where I just call one system function after another. You can find it here: https://github.com/curtisy1/OppoUnlocker/tree/services-research
[OPPO Find X2 Pro Guides, News, & Discussion] bladesss:
Postman is a PC program for API testing. Perhaps it will guide you somehow?
[OPPO Find X2 Pro Guides, News, & Discussion] curtisy:
Thanks. I'm currently switching between curl (as previously posted on page 3 or so) and Rester which is an addon for Chrome and Firefox to send my requests. I also figured out the basic structure of each request but getting the correct parameters is pretty tricky.

That's why I'm aiming to circumvent the request entirely if possible and call the unlocking code directly from a self-built app. Oppo does the same actually but they use what's called a system app (basically it already runs as root) so they have access to all the good stuff. There are some apps we do have access to though so we can call some internal Oppo code. If I'm lucky I might be able to find something faster than reversing the API, so that's the current goal. If it doesn't turn out to be successful, I can still resort to manually reversing the depth testing apk
[OPPO Find X2 Pro Guides, News, & Discussion] bladesss:
Ok, great job. I hope you will succeed, I keep my fingers crossed for success :) all xda counts on you:)