yashsingh1/xdaforums huggingface dataset:
[Google Pixel 3 Questions & Answers] DragonFire1024:
ok i was able to play around and get a better idea of the situation.To some extent the Pixels, like the Piel 3, use the CrOS Embedded Controller (EC). In theory, and to some extent I have proven the concept is there, we should be able to download the source code for the EC, modify the settings and configurations to our liking and what is available for our chips via make menuconfig, build the EC firmware and flash to the device it using fastboot oem citadel rescue. At this point it doesn't matter about the bootloader being locked. In theory, we could run a series of commands to the device when it is set in the right mode by enabling suzyq in Citadel. This would change the ID to 18d1:5014 when running lsusb in a linux machine and plugged into it with the suzyq cable. This opens up console control via usb_console in various modes like UART, something that definitely should not be happening on the locked Pixel 3. In the various commands is the means to disable firmware WP (write protection) by running commands commands like below on a linux machine or live booted linux. I dual boot Ubuntu 16 and Windows 7 on my PC:

ls /dev/ttyUSB*

if it returns /dev/ttyUSB0, /dev/ttyUSB1, /dev/ttyUSB2 or /dev/ttyUSB3, we are in business. In theory you could use the built in flashrom that exists in this mode to disable that write protection and flash the newly built EC firmware we modified. The commands would go something like this, and would HAVE to be run from a device booting Chromium or ChrmeOS because of the binaries used to do this, do not work outside their environments. Basically Google has added their stock flashrom bin to there official devices to achieve what we are trying to do. OEMS like Verizon and so on, modify or build their own flashrom bin that intentionally leaves out this ability. If we use a flashrom bin from a stock Google Chromebook, theoretically this will work. we are looking for /dev/ttyUSB0 when running:

ls /dev/ttyUSB*
.../dev/ttyUSB0
sudo su -
echo "wp false" > /dev/ttyUSB0
echo "wp false atboot" > /dev/ttyUSB0
echo "ccd reset factory" > /dev/ttyUSB0

You then can use the built in flashrom that exists in GOOGLES hdctools to flash the EC firmware we build to the Pixel 3 that's in the Cr50 (CCD) state. I have not looked at or downloaded the EC source code so I can't even begin to answer the question of what we might be able to do in terms of unlocking the device further. At this stage in Chromium you would be considered completely unlocked. I also understand very little about writing actual computer code so therefore am too illiterate to write an exploit, if one should be needed. However if we get this far successfully, even without an exploit (there would be a seriously significant risk of one being created), i will file a bug bounty with google. Getting this far successfully would very likely earn a CVE status and would literally affect an untold amount of pixel phones, chromebooks, tablets and laptops. perhaps many tens of thousands of devices or more.
[Google Pixel 3 Questions & Answers] DragonFire1024:
So I have not had a good luck with Chromebooks lately and I'm awaiting new one to arrive because less than a week after receiving it, the screen just happened to die one day as it was booting up. Will be back in the full swing hopefully within the next couple of days I'm just waiting for the replacement to come in. On that note I've been able to get hdctools to install locally and the developer environment of this Chromebook which isn't any kind of big news in of itself aside from the back it's the first time I'm able to actually get those tools to install it all. Which means it already installs all necessary dependencies and other packages needed for these tools to work properly unfortunately within a day or two after getting all set up the screen just died. Though you can install a subsidy of Linux onto the machine as part of the developer tools, it takes up a lot of space and there's not a lot more left to do very many exciting things but it does allow for the installation use of ADB however that option is already available once your machine is in developer mode anyways. What I've been stuck on is trying to get the pixel 3 to show up as the vendor identification and device identification I made in my last post. I might have something missing from a couple of the configuration but it just won't show up as the prototype device it was showing up as in previous investigations. the really cool part about all of this is the fact that it seems to all work and I have never been able to fully get these tools to fully work or operate on my Linux box because of various reasons that just don't make it possible. In some cases you can get as close to the real thing as you can but will never be fully operational because it wasn't designed to work on that system. I guess my next goal will be to download the embedded controller source code and see what that offers. I'm coming up on a few days off so hopefully I can get something done.
[Google Pixel 3 Questions & Answers] DragonFire1024:
So this may or may not be something interesting. I have been trying to track down what the exact functions of citadel are, aside from what we already know and came across a brief blog post that discussed two things of interest. 1) citadel has a 'boot rom' mode. Many devices I have come across over the years have exploited various boot roms to acquire root access. I will have to look into this more but this could be a vector. 2) the environment is UEFI based. On Chromebooks, the way to unlock them is to use custom firmware that is booted from a UEFI based environment, which enables the target device to boot nearly any kind of operating system such as Windows or Linux. It can also be used turn old laptops into Chromebooks. In most cases this is done because the stock firmware is no longer suitable for the devices and doing this is generally permanent. In theory this environment could be booted completely off device from say example and SD card or portable storage via USB on the go.

So never mind about the latest firmware having any effect on the devices abilities with the suzyq cable. But I am likely going to have to get a new cable because I do believe this one has worn out its use and I have gotten it to work and somewhat respond to the USB console however the device doesn't fully register the mode it's supposed to be in. So I guess that will be my next step
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Wish I could be of any help. The more you look into it the more promising it sounds though. I'm curious if this could apply to the Pixel 3 XL as well
[Google Pixel 3 Questions & Answers] DragonFire1024:
does anyone know if by chance the pixel 3s support using a custom public key for the bootloader's root of trust? The tool in the link might be useful if so.

I figured out what the 4 locks mean in citadel.

LOCK_CARRIER
LOCK_DEVICE
LOCK_BOOT
LOCK_OWNER

There is another tool that might be of some use, Verified Boot Storage Applet for AVB 2.0. m it is used to set the above locks. Some of it can be done in fastboot so I wonder if verizon missed blocking them out.

I have downloaded and tried a half dozen GSI images using the DSU loader and none of them will boot. The only one(s) that do, are images provided to us by google and are fetched when needed. It does however corrupt vbmeta. I have that warning again saying my device is corrupt.
[Google Pixel 3 Questions & Answers] eyoome:
I wish I could help...
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Out of curiosity does Google's Android 13 GSI images load?
[Google Pixel 3 Questions & Answers] t3chg33k:
Yes, they do. You can use DSU in Developer options or DSU sideloader app if you want to resize the data partition. However, practically it is of no use since it only supports 2G and is completely stock in terms of all the apps as well.
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Late but really interesting thought. The dirty pipe exploit. It functions on Google's Android 12 GSI Images. Potentially meaning we could gain root access via that
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Now that I'm looking into the dirty pipe exploit it actually seems pretty dang promising. If it could be used to write data to the OEM Unlocking slider via a GSI image that's still vulnerable to it we could unlock the bootloader from there
[Google Pixel 3 Questions & Answers] NANDO1413:
hi sorry my english lol

will it be possible to remove UFS 2.1 and reprogramm with UFS box? similar to this blackberry passport project.

Android on Passport | Project

Android on Blackberry Passport www.androidonpassport.com

www.androidonpassport.com
[Google Pixel 3 Questions & Answers] DragonFire1024:
Funny you mention this. I was manually updating my adb and fastboot on my ubuntu PC when I saw some new fastboot features. The one am most interested in is

fastboot create-logical-partition
fastboot delete-logical-partition
fastboot resize-logical-partition

I have only been bold enough to try half of this and see what response I got. Booted my pixel 3 to bootloader and ran in regular fastboot (not fastbootd) 'fastboot create-logical-partition TEST' to see if there was even a possibility this command works. I was hopng for an error other than "blah blah blas ...not allowed on a locked device". THis is the response:

adb reboot bootloader
fastboot create-logical-partition TEST
fastboot: usage: expected argument

Well it's not what I expected. Problem is, this seemed the safest way of testing this without actually trying to deleting anything. Not sure I am bold enough to try. Lets say it works...would flashing stock fix this? An OTA? If not, worst case scenario is an immediately bricked device. If it works, and device is not bricked, this could be all we need to get somewhere. I know this command (delete partition) is used on my Moto G play 2021. Without doing this (amongst other things) a GSI would not flash, not enough space. In order to fix this, we deleted product_a
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Curious what partitions exist? Also I don't see the relation to the dirty pipe exploit. But this is promising as well.
[Google Pixel 3 Questions & Answers] t3chg33k:
Dirty Pipe exploit was only for kernel version 5.8 - 5.10 and the proof of concept worked on select devices with those kernel versions at that time. Pixel 3 never went beyong 4.9.x, so the exploit will not work on it. Older known exploits like Bad Binder were already patched in 2019. Don't know of any other widely known exploit as of now but even otherwise, the path to rooting and bootloader unlocking might not be straightforward.
[Google Pixel 3 Questions & Answers] Bluedragon2008:
Oh but it's there if you look in the right place. The GSI Images my friend.
[Google Pixel 3 Questions & Answers] t3chg33k:
Are logical paritions not part of the GSI process? If so, it wouldn't require a locked bootloader anyway as it does not impact the actual partitions.
[Google Pixel 3 Questions & Answers] t3chg33k:
I doubt it. The exploit window was open for only a short period of time, for specific kernel versions on Android 12. I would be surprised if any GSI image from Google featured those kernel versions considering the GSI release frequency.
[Google Pixel 3 Questions & Answers] nuxlight:
Hello,

I bought a pixel on web and is Verizon too... I discover this possibility with the pixel...

Is just an idea but do you think there is a possibility with the EDL boot mod ?
[Google Pixel 3 Questions & Answers] nuxlight:
I said nothing, this is impossible to restore from this mode :(
[Google Pixel 3 Questions & Answers] t3chg33k:
You need vendor-signed EDL images with the appropriate tool to flash the images. Some Chinese manufacturers like Mi provide them. Google never provided the necessary firehose files even when the devices were bricking into EDL mode.

Combined with the fact that you cannot even flash factory images with a locked bootloader and that the repair tool does not even work with the last C2 release for the Pixel 3, I have concluded that Google is one of the worst vendors in terms of support.
[Google Pixel 3 Questions & Answers] nuxlight:
This is so sad... and Verizon is abusing... By the way, thanks a lot for all the work DragonFire1024 👍

And you can install a Google GSI but with phone problem, this is unusable.
[Google Pixel 3 Questions & Answers] bigfreakintaco:
@DragonFire1024 I have a lot of Pixel 3's at my disposal. I'm the creator of a custom ROM, and I'd be willing to try more invasive stuff to help you. I would love to be able to OEM Unlock verizon variant pixel 3's (as I repurpose them with a ROM for kids) and this would really really help purchasing refurbs on ebay. Feel free to PM me too.
[Google Pixel 3 Questions & Answers] nuxlight:
Do you think it's possible to flash the Google official ROM just after a citadel reset ?

I am not sure to understand but when you're made a fastboot oem citadel reset, you have the bootloader unlocked until reboot device ?

So it will be possible to flash with Google ROM ?

That will correct the corrupted warning message, maybe.

I can't try now, but I will be curious to check that this weekend 👍

PS : sorry for my bad english 😶
[Google Pixel 3 Questions & Answers] DragonFire1024:
as far as i recall, though that number defaults to a 0, i don't know, or really think it affects anything because the device wold require a reboot after performing the reset. that being the case, no you still can't flash any images. i still wonder about VB meta corrupting. technically speaking, nothing aside from google signed images in an OTA will be able to flash to the device, but yet a flash does happen somewhere in vb meta. Rebooting the system rests the numbers to their appropriate values no matter what. we need to obtain some logs and see what if anything registers in them at the time this citadel reset is performed. here is an idea. what about resetting citadel and rebooting only to recovery to check out the logs and see what they contain? on my pixel 4a, all 4 locks are set to 0, which signifies a bootloader unlocked device.
[Google Pixel 3 Questions & Answers] Rasal Rahman:
Did you unlocked the bootloader?
[Touch Pro, Fuze General] marios96:
Hey guys, i would like to know if we could enable through a registry hack or something, SecondToday to start automatically when we slide out the keyboard.

I don't really like the landscape version of manila so it would be better to have the normal today screen when the keyboard is out (But since we can't disable TF3D landscape secondtoday will do just fine). I've tried with sksChema and SecondToday but it doesn't have an option for sliding out the Keyboard.

If anybody knows any workaround for this, let me know, please...
[Android Head-Units] TorstenH:
Because I've seen many posts users want to keep their apps running after sleep mode I want to highlight this in a separate thread. Especially because it's simple for newbies and even possible on non-rooted devices:

https://xdaforums.com/t/use-swc-to-switch-between-navi-and-radio.4259683/post-84926989
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] manisa236:
I applied EU 12.0.5 OTA a few days ago. Today I noticed a new toggle called Work Mode in quick settings. I guess it arrived or activated with OTA. The toggle was on. Since I don't use the phone for work purposes I turned it off. It put a crossed briefcase icon (off work?) in notification area. See attachment. I wanted to remove this icon by toggling the Work Mode again but the toggle was disappeared from the quick settings. Now I'm left with this Work Mode Disabled icon in the notification area and it's very annoying. I couldn't find any other settings that is related to this. I searched Work in settings which suggested a Synch Work Mode toggle under Accounts & Sync but when I go there there's no such toggle. A quick Google revealed that Android Work Mode function does not work in MIUI and Xiaomi removed it from their ROMs. Looks like there are still bits and pieces remaining in their code and updating to 12.0.5 brought it back in Quick settings. Does anyone experienced a similar issue in 12.0.5? Do you see Work Mode in Quick settings? What happens when you disable the Toggle? Is it still there? I also reordered my Quick settings after that. Not sure editing the Quick settings layout made this toggle disappear. Thanks for your help.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] djuroue1:
No I dont have one.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] stevejc:
Hi, I've got the same icon after previous OTA. Now it's gone, but don't know what exactly I've done to get it disappeared. Maybe just a reboot.

Do you have cloned an app ? My microsoft launcher said a have a work mode because I have a cloned app.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] manisa236:
Hi thanks for the feedback. I have some social apps Whatsapp etc. cloned. But it wasn't there before the last OTA. Hopefully next OTA will remove the orphan Work More Disabled icon from my notification area.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] Krishnasathyaa:
hi i too got this crossed briefcase icon , MI sucks in update as usual . don't know when they will clear this error
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] manisa236:
If you have any of the dual apps (Whatsapp, Facebook etc.) enabled, MIUI asks you to enable the work mode (Yes/No choice), that's how enabled work mode again and got rid of the briefcase icon. I guess they use work mode framework to implement their dual apps functionality. I can access my dual apps again, briefcase icon is gone and I don't see any other difference.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] DrC0DE:
You may need to open settings/apps/dual apps, and then select settings and select delete dual apps and their accounts. Your device will be reboot and you'll find it removed from the notification area.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] Joshgo:
How did you do it? I just updated my poco x3 but i can't access my cloned apps it always show the work thing on my microsoft launcher
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] manisa236:
I'm using Poco launcher. When launched a cloned app it asked me to enable the work mode with a yes/no option. I clicked on yes and cloned apps started working again.
[Xiaomi Poco F3 / Xiaomi Mi 11X / Redmi K40] Divyesh18:
Hey ,i encountered this issue just now , suddenly a work profile toggle appeared so curiously i pressed it n the annoying briefcase logo appeared n the toggle suddenly gone , wow n i looked up on google for solutions n nothing works , then someone suggested to delete dual apps account even tho i don't have any n after it rebooted , the icon gone , yay ,hope this helps
[LG V50 ThinQ Questions & Answers] X-Nemesis:
I'm looking to buy a V50 in Canada (Telus), is there a specific model that I should buy over any other? Updating issues, bands, etc?
[Note Edge General] ElazarZiv:
Test3627
[Note Edge General] ElazarZiv:
Test2
[Note Edge General] Badger50:
What exactly are you testing? :unsure: :unsure:
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] iti_uk:
When I first got my kaiser I flashed the OliPof HardSPL v1.0 (SPL-1.0.OliPof).

I'm now trying to upgrade to a later HardSPL (3.56) and it doesn't appear to be updating, according to the rainbow-screen.

I've tried JumpSPL with no success. Any Suggestions?

Chris

edit: Solved.
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] jtclist:
how did you solve this? same problem here
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] DaveShaw:
In the 2nd post in the jockyw Hard SPL Thread there are two sets of instructions, read the second set.

Ta

Dave
[Tilt, TyTN II, MDA Vario III Windows Mobile ROM De] twistkill:
wow! you guys dint even use search, did you?

its in the stickies up there..spoon-fed!
[Samsung Galaxy J4+ Questions & Answers] Bluzito:
Hi!

My device is a J4 ( SM-J400M J400MUBSBCUC1 (B11) ( March 1 2021) )

I've been trying to root it, but failing :(

I'm trying to use the magisk method, but when I tried to install twrp via Odin this happens.

A friend of mine told me that it's because my OEM is not fully unloocked, but I already unlocked via devolper settings on the config menu, but when I enter recovery mode, doesnt appear that green screen tell me if I want to fully unlock to hold Volume Up, but instead he give me those options instead.

When I enter the bootloader via those options the odin fails to install the twrp like the first image.

Can someone help me ? :~

Thank you so much!
[Samsung Galaxy J4+ Questions & Answers] Bluzito:
Is up allowed? need some help plz xD ~~
[General Questions and Answers] abdullahal25:
I have sony Xperia XA Ultra with broken screen and usb debugging off

my device has bootloader unlocked, rooted with magisk and has TWRP custom recovery

also my laptop is RSA verified from my phone

all what I need is enable usb debugging or wifi debugging

also sorry for that but I need the guide to be as noob friendly as possible
[General Questions and Answers] abdullahal25:
I followed this guide and I could enable debugging

Android - Enable ADB from recovery

Android - Enable ADB from recovery. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

So my problem is solved.. sorry for bothering
[General Questions and Answers] chris1892006:
After a short period of time my keyboard & mouse disconnect. Can I fix this some how? I have root access.
[Samsung Galaxy A12] andrepalma24:
Hi,

I would like to get suggestions on a ROM to flash on A12,

Lineage is available?

Suggestions.

Thank you.
[Samsung Galaxy A12] Fandroid Tech:
Try some gsi roms.
[Samsung Galaxy A12] hd_scania:
Yes, i’m going to flash GSI’s on my PIT partition for system.img, but that partition isn’t found from my PIT file

An i’m encountering this error below on Heimdall,

Initialising connection...
Detecting device...
Claiming interface...
Setting up interface...

Initialising protocol...
ERROR: Failed to send handshake!ERROR: Protocol initialisation failed!

Releasing device interface...

But my Android side is below, and feels like ok,

Heimdall Download mode (high speed)
Product name: SM-A125F
Current binary: Samsung official
OEM lock: Off (U)
KG status: Checking
MTK secure boot: Enable
Warranty void: 0x0 (0x0)
PR SWREV: B1 NS1 K1 S1
Secure Download: Enable
CASS: 0x1
DID: 000ac3086b58
CARRIER_ID: TGY
[Samsung Galaxy A12] speedmetal444:
Im trying to install some GSI's too, the problem is that we have the system.img but to make the changes we have to flash it in the "super" partition, thats why Heimdall doesnt recognized it from the A12's pit... Please let me know if you guys solve it... :D
[Samsung Galaxy A12] hd_scania:
I guess, instead flash your GSI .img files on your super partition, and you instead need to download online PIT docs, according to your ‘‘Product name’’.😊
[Samsung Galaxy A12] hd_scania:
I tried to flash the Lineage GSI by Andy Yan on SF using Heimdall (yes i’m no longer on Windows), and also AOSP one, but unfortunately and somewhy,

SW REV check failed!
[Samsung Galaxy A12] speedmetal444:
I cant follow you :(, Im not so much familiarized with this dynamic partition but Ill try to...
[Samsung Galaxy A12] LAST_krypton:
For me, on LinageOs when I turn off the screen and then turn it back on screen touch doesn't work.

GSI 11 same problem and the 3 button navigation pannel not working.
[Touch Diamond, MDA Compact IV Themes and Apps] alfoalfo:
Hi to everybody I have a question for you:

I have on my diamond some apps that I click on them and the app start, so the problem is that this apps are not installed so don't appear in the programs list so how can i put this apps on the program tab ?

Sorry for my very very bad english I hope you understand and help me

Thanks in advance :)
[Touch Diamond, MDA Compact IV Themes and Apps] NLS:
it doesn't matter if it is "installed" it just needs to have a shortcut inside "start menu" (or any subfolder)
[Touch Diamond, MDA Compact IV Themes and Apps] alfoalfo:
Thanks man :)