yashsingh1/xdaforums huggingface dataset:
[Google Pixel 3 Questions & Answers] Hussnain9989:
I've noticed that when i reset my pixel 4xl through the recovery menu it doesn't let me continue on the android setup without connecting to wifi because it checks the sim lock and detects that i have a Verizon locked phone. So if we find a way to skip that will it allow us to unlock bootloader?
[Google Pixel 3 Questions & Answers] DragonFire1024:
Probably not. Even the last update, which wasn't provided by verizon, and changed some of the more known values in the props, didn't unlock the bootloader.

On another note, I had my Google pixel 4A stolen last week. so I've had to make a transition over to my pixel 3 as a regular device until I acquire another one. But insteresting things going on with it. Every now and then I take a look through the internet to see if there's anything new that might help us in our Quest. Of course I have not gotten lucky at least not how we would like to think anyways period however with that being said some weird things have been going on since I ran a few Scripts from a repository at GitHub. They didn't seem to do anything except for the next day I woke up and it seemed like visually there were a few things different about the phone but I didn't think anything of it until yesterday when I logged in to my Amazon account on my pixel 3. If I sign into a new device Amazon will send me a text message alerting me in case anything suspicious was happening. That wasn't the weird part it was the fact that it told me my phone was on Android 10. Just be on the safe side I checked the IP addresses and it checked out. A few days ago when I noticed some visual differences I even said to myself in the back of my head that it seemed like for some reason my phone was on Android 10 but everything that I can look at tells me it is still on Android 12 except for these two little things. On top of that it had almost seemed like my phone had been rooted but again there's nothing that I can tell that tells me it is. I decided to try and grab some logs but they were unhelpful and showed nothing out of the ordinary except for one thing and only one thing. I don't have a screenshot so I'll have to do this tomorrow or the next day or two, but there was a driver that was being loaded from Qualcomm which had a five or six letter and number combination of what version it was on or the system was on and according to those numbers it was Android 10. So I don't know....just thought I'd share this and see if anyone else was or had this experience.
[Google Pixel 3 Questions & Answers] Jhnoth:
What about this? https://eshard.com/posts/pixel6_bootloader_3. For some reason I can't load my abl binary in IDA64.

What I'm thinking is, we could use that exploit to patch the bootloader's unlock status. Or we could even use the fastboot raw download command to invoke the unlock process. I haven't really gone into the avb architecture and code, but that blog post has a link to the resources.
[Google Pixel 3 Questions & Answers] vonDubenshire:
https://xdaforums.com/t/unlock-any-pixel-from-carrier.4327595/#post-85566991
[Google Pixel 3 Questions & Answers] webhook:
For SIM Unlock, not OEM
[Google Pixel 3 Questions & Answers] Jhnoth:
I have an idea about how we, VZW-Variant folks, can fix this situation. Submitting FCC complaints about Verizon's bootloader policy. Enough complaints might just make VZW change their minds 🤷‍♂️.

I tried but they blew me off like it was nothing. I won't say why right now.

So first buy a Verizon line with a Pay-As-You-Go plan (idk if they have those). This is an important step for them to take the complaint seriously. Next, go to the link below.

https://consumercomplaints.fcc.gov/hc/en-us

Scroll to the bottom and right above the search bar you'll see "form". Click it and fill it. Don't forget to specify "OEM Bootloader Unlocking" to avoid confusion. Feel free to add argumentative points such as:

Idk that's all I could come up with on the spot. Try to make the argument sound like something anyone could litigate. Also try ask ChatGPT for some ideas, maybe that'll help.

And for a larger impact try to spread the idea to other forums (Samsung, Nokia, Motorola).
[Google Pixel 3 Questions & Answers] DragonFire1024:
Well I've been at a stalemate for a bit because my suzyq cable stop functioning. Now it took this long to get back in the game because they are impossible to find now. The original vendor spark fun, stopped selling them and therefore so did everybody else. However somebody took it upon themselves to put together a homemade one and decided to sell them on eBay.Mine arrived yesterday and I have to say it is functioning very well and now that I am on my Chromebook where I'm hoping this will be a lot easier, it seems like all the connections are a lot better than they are on a Windows computer or even Linux. I will have to do a skim over of the thread and figure everything out again or at least get caught up to speed. After doing so hopefully we will have more answers than questions
[Google Pixel 3 Questions & Answers] webhook:
I was thinking "What if we can take a device setup APK from an unlocked Pixel and trick the device to activating to the unlocked servers or better yet to your own server"

Just something I had in my head lol
[Google Pixel 3 Questions & Answers] DragonFire1024:
I mean it's plausible. It's a matter of whether or not we can over right the system APK when installing the new one as an update. In some cases it may not let us do that.
[Google Pixel 3 Questions & Answers] Severus_:
you must reset via settings then reset again with recovery mode, it will remove wifi requirement.
[Google Pixel 3 Questions & Answers] novadaemon:
I don't know if this will help you, but I have a pixel 7 pro that was locked to spectrum (Verizon MVNO), and I had sent it off for RMA repair. It came back to me with its bootloader unlocked, it became carrier unlocked and NOS Production set to No.

So, I literally have the thing you want and I know for a fact it is possible to do what you are trying to do, but the only way I've seen it done is from someone at Google's RMA department forgetting to relock my phone.
[Google Pixel 3 Questions & Answers] DragonFire1024:
Yes unfortunately the only way to launch some of those activities is with elevated access usually root access. However if you can figure out the strings then you can run 'adb shell am start ...'I have tried using the ADB function and I am very awful at being able to put the strings together properly so the command fails before it even gets a chance to try and launch an activity LOL.

Just a quick side note you can download IceBox - Apps Freezer from the Play store, then remove all accounts from the device (you do not need to perform a factory reset) and you can make icebox device owner and feeze whatever system applications you want (same as disabling). You can also use this application to download app ops by Rikka and designated as the delegated device administrator and run apps without having to have root access or install xposed.
[Google Pixel 3 Questions & Answers] Pixel 3xl:
Appreciate your experiments. I think there might be some ways to solve this problem.
[Google Pixel 3 Questions & Answers] DragonFire1024:
In regards to the changing of vbmeta.img, there is one thing that is no longer part of the properties (adb shell getprop):

ro.boot.veritymode

Its no longer enforcing. It now says:

ro.boot.veritymode=eio
[Google Pixel 3 Questions & Answers] DragonFire1024:
You know I started experimenting on this phone for no particular reason because I honestly do not have any complaints about it aside from the fact that I was misled about it being a Verizon variant. And I told myself even despite that fact I wasn't going to tinker with it and I just could not resist. I definitely think we're in some kind of rabbit hole, as one user said a few days ago. The question is is whether or not it goes anywhere I think it does but I am very inexperienced on this end of the device spectrum so I could be chasing ghosts so to speak.
[Google Pixel 3 Questions & Answers] DragonFire1024:
So I've had some discussions with Google not about what I'm trying to accomplish, here but in regards to eSIM functionality. I did so because I am waiting to have service activated with Google fi. So I attempted to do so using the esim functionality. It does not work. However there is light at the end of the tunnel

So I've had some discussions with Google not about what I'm trying to accomplish, here but in regards to eSIM functionality. I did so because I am waiting to have service activated with Google fi. So I attempted to do so using the esim functionality. It does not work. However there is light at the end of the tunnel. I have suspected for some time that Google does not have a clue what Verizon does to their devices once they distribute them to Verizon. So believe it or not I've actually talked to a real person in depth about eastim functionality and why it does not work on these devices and only the ones from Verizon. I was very careful in words I chose because I wanted a genuine reply instead of something generic or a stupid reply like Verizon would give me. They told me the functionality was not available on Pixel 3 devices that had a sku associated with Verizon. I then ask is it because of the hardware Verizon uses once they leave your facility or is it simply a software restriction you have no control over. I am posting their reply below. In a nutshell they essentially tell me if I've gotten this far I can probably find a way to fully activate it and it seems like if I do they won't have a problem pushing the functionality to all pixel 3 devices. But until then they don't have a clue how Verizon restricted the functionality but essentially invited me to find out how:

They also noted if you write to them or if you can find the option on their page they will actually send you a physical SIM card for free. Otherwise you will have to pay $10 to get one off Amazon or other websites
[Google Pixel 3 Questions & Answers] DragonFire1024:
Update:

Found this when trying to find a link between suzyq/suzyqable and citadel. https://alexbakker.me/post/mysterious-google-titan-m-bug-cve-2019-9465.html

It's not this bug the individual wrote about or the app he created that gathers the info he wanted that interests me but the error he gets:

chatty : uid=1064(hsm) /vendor/bin/hw/citadeld identical 5 lines
12-24 16:24:20.357 806 806 E /vendor/bin/hw/android.hardware.authsecret@1.0-service.citadel: Incorrect Citadel update password
12-24 16:24:29.466 825 825 I /vendor/bin/hw/android.hardware.oemlock@1.0-service.citadel: Running OemLock::setOemUnlockAllowedByCarrier: 1
12-24 16:24:29.473 584 584 I chatty : uid=1064(hsm) /vendor/bin/hw/citadeld identical 1 line

Do you see it?

/vendor/bin/hw/android.hardware.oemlock@1.0-service.citadel: Running OemLock::setOemUnlockAllowedByCarrier: 1

I was unable to Shell into the device and copy the vendor directory and its contents onto my PC, but I was able to mount the vendor image, did sudo -i, CD into the image and copy the bins in /vendor/bin to home directory on my PC.

Is there any way we can exploit this and change this property? There are citadel files in vendor/bin/he but not the same ones mentioned in the above link. That doesn't necessarily mean anything though. Would appreciate somebody with more knowledge about these type of things to chime in. What is user and group hsm? I looked in the source code for the boot image and the service listed in one of the init files does not list the permissions of these been files as 'user root' so is there any way we can pose as hsm and instructs citadel to change this value to a 1?
[Google Pixel 3 Questions & Answers] DragonFire1024:
Found a Debian based hdctools installation that works *without* having to setup a chromium based chroot. Going to take a bit to install and configure everything. If anyone is interested, the installation is here: https://gitlab.collabora.com/chromium/servod-tools

Note: even if this works for me, it won't work for you unless you have the suzyq cable or you modify an existing usb-c cable. Supposedly this cable, and when configured properly, automatically opens up consoles and uart, when connected to the device. This should only be possible if the device is unlocked *unless* you are able to enable the suzyq function without unlocking the bootloader. In this case we are able to do just that. And from what I gather, we aren't supposed to be able to enable suzyq at all.
[Google Pixel 3 Questions & Answers] Pixel 3xl:
If it works, could you please post a tutarial?
[Google Pixel 3 Questions & Answers] DragonFire1024:
So I just completed the first phase of configurations. I had to make sure my rules.d configs were right. Although they were, they were missing a few entries, but I can confirm the cable *DOES INDEED WORK!!!* It is functioning and it appears a console(s) are indeed opening upon plugging in the phone to a properly configured pc and environment. To what extent and what consoles? I do not yet know. Run this command in a terminal to monitor when Cr50 device emulation is activated on the device we are working with. If the device appears in the list (refreshes every few seconds), the device is successfully recognized, uart should be enabled aloing twith the Cr50 emulation (what we were banking on being available):

$ watch -n 1 "lsusb | grep 18d1:5014"

5014 is what the Pixel 3 is identified as while this emulation is occuring. The cable MUST be plugged into the PHONE port with the text ADBG facing UP, or the device will not be triggered into the mode we need it in (device is still booted and turned on and usable). Posted below is a screen shot when running 'lsusb' in a terminal, the PC is properly configured and the emulation is ocurring:

I don't know if this had an effect, but depending on what fastboot mode you are in, (fastboot vs. fastbootd), the device ID changes, so I added the config to the rules.d files I have set up in /etc/udev.

Fastboot: 18d1:4ee7

Fastbootd: 18d1:4ee0

Once I did that, installed the required dependencies for hdctools cleared my cache and what not, and rebooted, all was working so far, as it should. Now time to research a little and see what I can do and where can find instructions on how to do it :D
[Google Pixel 3 Questions & Answers] DragonFire1024:
UPDATE:

Well I can confirm UART is initialized. According to https://chromium.googlesource.com/c...b/docs/case_closed_debugging_cr50.md#ccd-open run the command:

usb_console -d 18d1:5014

Then some information should be returned according to the link above:

At the Cr50 console, use the version command to make sure you have a recent enough version to use CCD. The relevant version is either RW_A or RW_B, whichever has the asterisk next to it.

Here is what is returned when my Pixel 3 is attached with suzyq and running the usb_console command above:

:~$: usb_console -d 18d1:5014

--- UART initialized after reboot ---
[Reset cause: rdd]
[Retry count: 1 -> 0]
[Image: RW_B, 0.0.3/brick_v0.0.8279-f93f99159371.195216 update_rollback_mask: stop at 0]
[159371.195856 gpio_wiggling: AP_EL2_LOW_IRQ = 0]
Console is enabled; type HELP for help.
> [159371.238856 passthru usb]
[159371.239492 usb_init, resume 0]
[159371.606672 usb_reset, status 4801020]
[159371.695496 usb_reset, status 9028]
[159371.779716 SETAD 0x11 (17)]
rx [Errno 110] Operation timed out

I have no time to type anything and the rx error just repeats itself over and over. Not sure what to make of this...
[Google Pixel 3 Questions & Answers] DragonFire1024:
rebooting the device into fastboot (adb reboot-bootloader) and running the usb_console command returns this:

usb_console -d 18d1:5014
[161155.250820 gpio_wiggling: VOL_DN_L = 0]
[161155.251544 km_set_vol_dn_btn: vol_dn already set]
[161155.458140 gpio_wigglingl dn released]
[161156.020804 gpio_wiggling: PHONE_ON_L = 0]
[161157.550416 ap_reboot_actions: signaling]
[161157.550976 ap_reboot_actions: 0 done 0]
[161157.551540 ap_is_rebooting: MSM_RST_OUT_L_FALLING: ap_is_in_bootloader=1]
[161157.554112 flash_physical_write: 0x73d00, 0xec bytes]
[161157.554916 nugget_dispatch_loop: [161157.556064 flash_physical_write: 0x73c00, 0x100 bytes]
reboot seen (vol-dn: 1)]
[161157.559688 flash_physical_write: 0x73e00, 0xec bytes]
[161157.561736 flash_physical_write: 0x73d00, 0x100 bytes]
[161157.563424 gpio_wiggling: VOL_UP_L = 0]
[161157.588992 passthru off]
[161157.622916 ap_reboot_actions: signaling]
[161157.623476 ap_reboot_actions: 0 done 1]
[161157.624044 ap_is_rebooting: MSM_RST_OUT_L_RISING: ap_is_in_bootloader=1]
[161157.624980 nugget_dispatch_loop: reboot seen (vol-[161158.725452 usb_reset, status 9020]
[161158.809772 SETAD 0x21 (33)]
rx [Errno 110] Operation timed out

Again the rx error repeats over and over. Note: Unless the device is rebooted, or it's mode is switched (fastboot vs fastbootd) then the above information will NOT reappear. Instead the message referenced in the post abive this one appears:

--- UART initialized after reboot ---
[Reset cause: rdd]
[Retry count: 1 -> 0]
[Image: RW_B, 0.0.3/brick_v0.0.8279-f93f99159371.195216 update_rollback_mask: stop at 0]
[159371.195856 gpio_wiggling: AP_EL2_LOW_IRQ = 0]
Console is enabled; type HELP for help.
> [159371.238856 passthru usb]
[159371.239492 usb_init, resume 0]
[159371.606672 usb_reset, status 4801020]
[159371.695496 usb_reset, status 9028]
[159371.779716 SETAD 0x11 (17)]
rx [Errno 110] Operation timed out
[Google Pixel 3 Questions & Answers] DragonFire1024:
Ok I got the rx error to stop. There are so many dependencies for all of these utilities, it's a miracle I haven't screwed anything up yet.

If I can get the EC console working, that's where we can flash EC firmware. We also have EDL mode (adb reboot edl) where, if I can get it working, "Qualcomm Sahara / Firehouse Attack Client /Diag Tools": https://github.com/bkerler/edl.git

I don't know if this is something to do with my configurations not being right but for some reason Ubuntu refuses to read the existence of a device in edl mode. At least in terms of running commands, it doesn't exist. We'll need to definitely install drivers on Windows and get Ubuntu to carry them over. But the tools used for a lot of edl are available only on Windows.

But getting that to run on a Linux machine is not going to be easy so it looks like I'm going to have to boot up my Windows 7 if I'm to even try because the drivers are only able to be installed there.

I again was looking through the vendor image. Since I'm trying to access the EC console, I started to look for files related to it. There are 2 files in the vendor image: ec.bin and ec.rec. looking through both are intriguing, but the bin file even more so which I have yet to finish looking through using a hex editor. There are or at least appear to be in readable format, several strong box keys. There is one option in fast food I have yet to try, because of the lack of anything to test.

fastboot flashing unlock_bootloader <request>

Now it doesn't fail or give me a warning that I can't run the command on a locked device but it tells me to provide a bin file. I was unaware This phone had a bin file to flash when requesting a bootloader unlock. I haven't gotten enough courage to try it but wouldn't it be a son of a gun if ec.bin worked? Also I have a few different variants of fastboot that have been modified in various other forums in an attempt to bypass some of those restrictions and hoping to get commands working that normally wouldn't on other fastboots.

It probably wouldn't which brings me to the latest update overall. Those files tell me there is a EC console available. But I am having a very hard time getting it set up properly. Most of these tools when configured right will work properly if you have all the dependencies which has been the real kicker here, finding them all. If I can finally get that end of the tools working, then we can update the EC firmware with newer EC bins. And somehow using that same cosole, you can remove write protect on certain other firmwares. I know the council is active or is available because of the certain values I got in which I posted above. Some of stuff I posted above actually comes out of that console.

All we need is just that one little area to write on, that we can write to an exploit in an attempt to get root privileges if at the very least. I'm sorry I don't have any more than this for today.
[Google Pixel 3 Questions & Answers] DragonFire1024:
All right so I couldn't figure out how to copy text out of the hex editor, but of the hex copied quite perfectly. I'm on my work to work right now so I can only give a brief description of what I saw in EC.bin

I have a couple of questions perhaps some of you could answer. What is Weaver? Secondly what would an 'out of bounds' have to do in this neck of the woods? Weaver erases quite a few things including, if I'm reading correctly, several certificates, or rather wipes wherever they are stored essentially leading to some kind of mismatch that says out of bounds and then proceeds to show Weaver wiping those certain areas and by the time is all said and done if I'm reading correctly AVB is somehow set to "OFF!" and I don't know what is done after that. But somehow this starts off with rebooting citadel, and why do you ask? Because resetting it changes the bootloader state to zero and that's where a lot of this starts to come in. So until I find another hex editor where I can copy the text instead of the hex, I will have to start typing it out when I get home tomorrow. I'm very much paraphrasing so please don't get too excited but this tells me a lot more about what I can do with the proper consoles open. So whatever Weaver does leads to some kind of out of bounds exception where authorization is no longer required and somehow turns something to do with AVB in the off position
[Google Pixel 3 Questions & Answers] DragonFire1024:
I may have a crazy but yet working theory on how all this can work. Might even have a POC in the making here.

The post will be lengthy so I'm just going to say this. There's a high probability that I am very likely to cause irreversible damage to this phone even after one shot. So long story short I think that flashing that ec.bin is the answer, but only after very specific steps are taken in order to cause the domino effect as a result of resetting citadel. Remember in the very beginning I said that resetting citadel set the bootloader value to 0. Citadel can only be reached two ways: ap_fastboot running 'fastboot oem citadel', and the usb_console via suzyq cable. As long as the device stays in ap_fastboot after resetting it, the bootloader will stay value 0. Use citadel to tenable Suzyq (idk if needed for the rest though) then flash the EC.bin 'fastboot flashing unlock_bootloader ec.bin'.

Now I do not expect flashing this bin will work, at least not how you think. With the bootloader at 0, flashing that file, regardless of anything, sets the stage for why I say 'out of bounds' which is mentioned word for word in that bin file.' that's where Weaver and the rest of it follows and ending with AVB off.

Remember those CVEs I linked? 😮