yashsingh1/xdaforums huggingface dataset:
[General Topics] Renate:
A bit late now, but it's helpful to check compatibility first.

If you are rooted and can pull partitions, pull xbl and abl (heck, any partition with an ELF file).

You can use qcomview.exe (in the sig) to print the fingerprint.

The fingerprint may not show the same numbers as the "PK_HASH" from EDL, but the fingerprint from everything on your system (and everything you try to flash on your system) should be the same.

xbl packing

So, now that we've covered the abl packing, let's look at the xbl packing.

I was trying to figure out where the splash screen comes from.

There is a partition named splash, but it's 128 MB of zeroes.

I can tell by the comments in the hardware console that it load 88 kB of (Windows) Bitmap.

I've searched the whole (32 GB) flash and there is no Bitmap in the clear.

(Sometimes they put that stuff in the no-man's land between MBR and 1st partition.)

Ok, but I can't even find the comment "lcd_display_bitmap" in the clear in the whole flash or xbl.

I erased the abl and rebooted and I still get a fresh splash screen, so it's in the xbl (or friends?)

I thought maybe rpm or pmic, but there is nothing there.

So, looking at the xbl (which is a signed ELF):

# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 960 000000 00000000 <-- Program table
1 null 6952 001000 9fdb6000 <-- Signing
2 load RX 350012 003000 14015000
3 load RWZ 0 058740 14077000
4 load RW 31844 058740 1407a000
5 load RWZ 0 0603b0 14084800
6 load RWZ 0 0603b0 85e00000
7 load RX 11824 0603b0 146ae000
8 load RW 2916 0631e0 146b1000
9 load RWX 107032 063d50 14098000
10 load RWZ 0 07df70 146b2000
11 load RWX 1792000 07df70 9fc00000 <-- UEFI volume
12 load RX 78208 233770 14699000 <-- This is a complete ELF file inside an ELF program segment
13 load RX 171536 2468f0 85e35000
14 load RW 6409 270700 85ea8000
15 load RWZ 0 272010 85e97000

Edit: So, the included ELF is signed.

Just to keep us on our toes the signature_size and cert_chain_size are zero.

Both of those exist, but the certificates are entirely different than in the main ELF.

# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 400 000000 00000000 <-- Program table
1 null 11888 000190 146ad000 <-- Signing
2 load 0 003000 00000000
3 load 0 003000 00000000
4 load RX 49152 003000 1469c000
5 load RW 16768 00f000 146a8000

And I just checked. None of these program segments are yet another ELF file.
[General Topics] cuynu:
I penetrated inside the firmware of xz2, it has partitions like abl,xbl,xfl,etc but file extension is MBN, not ELF
[General Topics] Renate:
I wouldn't trust file extensions, they're all over the place.

ELF32 files start with 7f 45 4c 46 01

ELF64 files start with 7f 45 4c 46 02

Some files start wih 55 ff ed ff, they're normal signed ELF with 12 bytes of who knows what in front.

Some files start with d1 dc 4b 84, they're probably the MBN style???
[General Topics] Renate:
Not my friend!

Oh, yeah, nice to have some variety. I was getting bored with LZMA.
[General Topics] cuynu:
All of bootloader related file in firmware are .MBN and qcomview does not work, even i renamed to .ELF
[General Topics] Yahoo Mike:
I also have this nested ELF.

Binwalk flags it as a VxWorks image (?). If it's not a false positive id, then it seems like overkill to use VxWorks too.

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 64-bit LSB executable, version 1 (SYSV)
1008 0x3F0 Certificate in DER format (x509 v3), header length: 4, sequence length: 1059
2071 0x817 Certificate in DER format (x509 v3), header length: 4, sequence length: 1106
3181 0xC6D Certificate in DER format (x509 v3), header length: 4, sequence length: 1061
73946 0x120DA VxWorks symbol table, big endian, first entry: [type: uninitialized data, code address: 0x200, symbol address: 0xFF000000]
74139 0x1219B VxWorks symbol table, little endian, first entry: [type: uninitialized data, code address: 0x710, symbol address: 0x10]

Edit: does this segment (in the parent ELF) have high bits set in the program header p_flags field? Mine is set to 0x05000005. Those high bits are not documented in man elf. Any idea what they might be?
[General Topics] Yahoo Mike:
I don't have any experience with Sony devices. So I'm not sure that this is the right advice..

If flashtool doesn't work for you, ask on the XZ2 forums if anyone knows how to force your device into EDL mode using button combos or testpoints.

For example, when I brick my device by loading an invalid ABL, I get stuck in QCom 900E mode with no access to edl, fastboot, adb or recovery - I have to use testpoint recovery. If there are testpoints on your device (not all devices have them), then they will force your device into EDL mode (bypassing the ABL problem you have) - so that you can download the stock ROM using whatever tool you normally use (like flashtool or the official Sony tool). If you are a noob, this might be too difficult and you might have to find a repair shop that can do it for you.
[General Topics] Renate:
qcomview doesn't care about file extensions, but it only can decode ELF files.

I believe that MBN was only used previously and most everything now uses ELF?

I can't even find a good reference on MBN files.

Yeah, I see high bits there, but also on pgm0 (program table) pgm1 (signing).

Edit: pgm0 has 0x07000000, pgm1 has 0x02200000, pgm11 has 0x05000005.

I see in a Moto Firehose 0x01000000!

Why didn't they just make that 2 instead of 2.2?

So I chopped down the xbl to pgm11 and this is what 7zip makes of it:

Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
D.... 8AF09F13
..... 3888 8AF09F13\0.raw
..... 151752 8AF09F13\1.te
..... 7342 uefiplat.cfg.raw
D.... 9E21FD93
..... 559899 9E21FD93\1D301FE9.0
------------------- ----- ------------ ------------ ------------------------
722881 1792000 4 files, 2 folders

In that 9E21FD93\1D301FE9.0 I don't find any GZIP 1f8b08.

7zip doesn't know anything either.

It starts like this:

00 00 00 00 00 03 ec 7d 77 7c 14 d5 da ff 99 99
94 dd f4 de 61 13 a2 92 84 1e 6a 10 cd 24 a1 87
22 01 01 b1 90 80 25 10 14 02 28 45 31 1b a2 57
cc d2 06 23 08 78 25 41 af b2 a3 20 25 21 e4 5a

Did you mean deflate?

8AF09F13\1.te starts with 56 5a 64 aa, "VZd".

uefiplat.cfg.raw is a great source of some bits of memory map that I haven't managed to salvage from the DTB.

8AF09F13\0.raw, true to its name is all zeroes.

On some devices if you brick them after abl you still might get stuck with 900e (instead of 9008).

Sometimes abl (if you still have it) has hardware console ways to get out, usually wacky.

See: https://xdaforums.com/t/uart-control-of-android-boot-abl.4551723/
[General Topics] cuynu:
I already putted device to EDL mode by testpoint, but the VID and PID is 0fce:ade5, not like other EDL devices (xxxx:9008)
[General Topics] cuynu:
Flashtool and Emma/Sony Companion repair mode does not work in EDL mode, its only say device is locked or debugging off. that why i'm here till now
[General Topics] Renate:
You either have to copy and mod and install unsigned the Qualcomm driver

or else use Zadig to install the generic WinUSB and use either the Python EDL or my EDL.
[General Topics] Yahoo Mike:
Find those bytes in a hex editor, then go back 3 bytes and voila...there's your 0x1f8b08.

7zip doesn't know how to interpret the data.

To workout what's going on we have to consult your not-friend: the UEFI spec.

If you go back 0x18 bytes from 0x1f8b08, you'll get to the UEFI section header that encapsulates the gzip data.

Here's an example from my xbl.elf.

...
0x0000020821FA9540 68 23 1d 02 e9 1f 30 1d h#..é.0.
0x0000020821FA9548 79 be 53 43 91 c2 d2 3b y.SC‘ÂÒ;
0x0000020821FA9550 c9 59 ae 0c 18 00 01 00 ÉY®.....
0x0000020821FA9558 1f 8b 08 00 00 00 00 00 ........
0x0000020821FA9560 00 03 ec 7d 79 78 94 45 ..ì}yx”E
...

68 23 1d = 0x1d2368 is the size of this section (including the header) in bytes (little endian)
02 = 0x02 is the section type: EFI_SECTION_GUID_DEFINED
e9 .. 0c = GUID: { 0x1D301FE9, 0xBE79, 0x4353, { 0x91, 0xC2, 0xD2, 0x3B, 0xC9, 0x59, 0xAE, 0x0C } }
18 00 = 0x0018 is the offset to the data payload (relative to beginning of the header) in bytes
00 01 = 0x0001 is the section attribute: EFI_GUIDED_SECTION_PROCESSING_REQUIRED
1f 8b .. = data payload

EFI_GUIDED_SECTION_PROCESSING_REQUIRED tells us "you can't just parse the payload - you have to do something to it first".

EFI_SECTION_GUID_DEFINED tells us that the GUID in this header identifies how to pre-process the payload.

The GUID beginning 0x1D301FE9 is predefined and tells us "this payload is compressed using GZIP". If by some chance you have a different GUID, what is it and can you post a link to your xbl.elf?

The size of the payload is the total size of the block (0x1d2368 in this example) minus the offset (0x18). Note that, unlike LZMA, gzip doesn't have a header containing the size of the uncompressed data.

7zip knows that this section requires further processing, but obviously doesn't know how to interpret this GUID.

BTW, the GUID for LZMA is: { 0xEE4E5898, 0x3914, 0x4259, { 0x9D, 0x6E, 0xDC, 0x7B, 0xD7, 0x94, 0x03, 0xCF } }. Open your ABL.ELF in 7zip and you'll see the "PROCESSING_REQUIRED" file that contains the LinuxLoader has "filename" beginning EE4E5898. 7zip recognises that pre-defined GUID as "this payload is compressed using LZMA".

Anyway, that should be enough info for you to work out how to extract the gzip. Alternatively, I have a dodgy C++ class library that will extract it for you, if you want it.

Absolutely fascinating. If I had more time, I'd go buy me one of those USB to TTL UART converter thingys...and then try to nut out what on earth that thread is all about.
[General Topics] Renate:
Thanks!

I don't know why 7zip throws up its hands. If you prod it, it goes through with extracting the 87 files inside.

I'll have to sit myself down and read it some time.

Unfortunately, I'm 430 pages into "War and Peace" right now (honestly) and I have to see what happens to Napoleon.

Edit: Fun fact: The UEFI Specification is longer than "War and Peace".

All those u-boot or abl have some sensing of "magic" key presses but they are all non-standard.

I've never gotten anything to work with "EDL cables".

Still, I keep a magnetic reed switch on my main device so that I can always go to EDL without opening the case.

That's why experiments like erasing abl are not a big deal.
[General Topics] Yahoo Mike:
In the UEFI spec, there's a few signatures used to identify the type of an executable image:

MZ - DOS (PE32)

NE - OS/2

LE - OS/2 LE

PE\0\0 - NT

VZ - terse executable (TE)
[General Topics] AkayamiShurui:
Linaro Git Hosting

git.linaro.org
[General Topics] Yahoo Mike:
Here's a hint.

All those drivers in the XBL elf... Do a github-wide search for "VerifiedBootDxe".
[General Topics] 99degree:
below blog shows how to extract uefi and embeded files of xbl.mbn

Comparing Qualcomm’s XBL UEFI bootloaders on Snapdragon 820, 835, and 845

I compared UEFI bootloaders from Google Pixel XL, 2XL, 3XL, and Lenovo Miix 630 to show how Qualcomm used the flexibility of UEFI to support Android and Windows.

worthdoingbadly.com
[General Topics] 99degree:
just in case the phone or soc itself is not secured efuse burnt, aka without secured-boot, or have failsafe path for accepting fake cert like snapdragon 400 series soc, then below tool can help repack the mbn file with your own cert

GitHub - msm8916-mainline/qtestsign: Simple tool to "sign" ELF Qualcomm firmware images using dummy certificates ("test keys")

Simple tool to "sign" ELF Qualcomm firmware images using dummy certificates ("test keys") - msm8916-mainline/qtestsign

github.com
[General Topics] Renate:
If you have modified a secure ELF file (on a non secure-boot system) you don't have to modify the signing/certs, just redo the hashes.

qcomview.exe (in the sig) can do that, qcomview /hw abl
[General Topics] Renate:
Here's your answer:

S - Secure Boot: On

:(

Sequence
├──Set
│ └──Sequence
│ ├──OID 2.5.4.6 Country
│ └──Printable string SE
├──Set
│ └──Sequence
│ ├──OID 2.5.4.8 State
│ └──Printable string SE
├──Set
│ └──Sequence
│ ├──OID 2.5.4.7 Locality
│ └──Printable string Lund
├──Set
│ └──Sequence
│ ├──OID 2.5.4.10 Organizational unit
│ └──Printable string Sony Mobile Communications Inc.
├──Set
│ └──Sequence
│ ├──OID 2.5.4.11 Organization
│ └──Printable string Flash Security
└──Set
└──Sequence
├──OID 2.5.4.3 Common name
└──Printable string Tama com Root

Unless you have some very good friends in Sweden...
[General Topics] Renate:
Most of the time you could care less about all the UEFI trivia.

An ABL is a single chunk of code, less complicated than an XBL.

Unless you don't have Secure Boot the only thing you can do anyway is to look at the code.

So I wrote a little utility to skip over all the gobble-dee-gook and just give you the file.

C:\>flatten abl out

Now you have a file to disassemble. Or just to look for strings.

Has your OEM just gutted fastboot? Search for "flash".

flatten can also stitch the separate program chunks in XBL into a contiguous file.

See: www.temblast.com/flatten.htm
[General Topics] platinumthis:
I have the same problem, could you look also here? Asus also removed the unlock tool and lie since then its in revision, tried so many things and stumbled over this thread here, i even tried to flash all partitions possible from a unlocked phone from edl via a dump except super.img over to a locked phone which didn't help, i saw that not all partitions where showed like in userspace.

Also i tried this flatten programm but dont know how to disassemble or to look for any more fastboot commands after i got the output file
[General Topics] Renate:
I've never seen so many oem commands in an abl before.

I'm not sure about those commands with trailing _. Try with/without.

Spoiler content hidden.
[General Topics] platinumthis:
I looked in Hex edit online, for me is only the unlocking of the bootloader interesting, and also to see if it have secure boot. I think i saw it was enabled when i used fastboot getvar all. You see even when i flashed from an unlocked phone to a locked phone containing the partitions abl xbl and some other too it was still locked and was not abel to boot up twrp. Interestingly i saw in the abl img its refers to asuskey2 partition. But i dont know how to look into it, maybe it has a key inside for unlocking ? Also if you search just asus you get straight to unlock with a number, i dont know what that means but maybe i can flash a txt file code for unlocking? I always get permission denied error when using fastboot flashing unlock. Normally you use that app which is not available anymore.

Tested all commands,

I get

FAILED (remote: 'Verify unlock token fail.')

when trying fastboot oem asus-unlock

all others interesting i get: Not allowed in locked state or permission denied

here is are the asuskeys
[General Topics] Renate:
No idea what an asuskey is. Are there 6 partitions named that?

It's probably something you have to send to an Asus server to get the unlock key for all those features in abl.

I'm not going to dive deeper into your abl, but somebody else might want to.
[Fire HD 8 and HD 10 Q&A, Help & Troubleshooting] develerios:
hi and before i stard sr<y for my bad english :D also i have a problem with my Fire HD 8 Kids edition if i start this comes the setup and i set my wlan and than he want login with amazon and this not work my data 100% right but no way this tab says me anytime my data are incorect so my problem i buy this from ebay so no way for me to ask amazon support i already flash the last official firmware from amazon i make a factory reset but all not help anyone has a idia ?
[Android Head-Units] Kevkos1983:
Hi,

I recently purchased a usb cable for my android head unit and the lead doesn't work. I didn't buy the unit so I don't know the brand etc. The unit was in the car when I bought the car.

I'm guessing the wires that plug into the usb connection are in the wrong order. I have no way of finding out the correct order. Does anyone on the forum know the correct order or even show me a picture of their usb cable.

I've bought 2 cables so far, neither of them have worked and they cost close the £100. It's very frustrating that I can't get them to work

Thanks in advance
[Android Head-Units] TNSMANI:
MOD ACTION:

Thread closed as duplicate of https://xdaforums.com/t/12-pin-usb-connection.4473821/

@Kevkos1983

Please check Rule 5 and do not spam the forum:
[Touch Cruise General] fitzybaps:
HI, can someone advise please, I have an Orbit 2 running 6.0 and running a Macintosh, I have no access to a PC, my question is can I upgrade to 6.1 from my SD card with a cab file? I have a piece of software that enables me to extract any cab file from the exe file. Any advice would be much appreciated.

Thanks

:confused:
[Android Head-Units] marchnz:
What does the seller suggest and what happened when you tried that.

Also, with no information and detailed screenshots, how did you want help
[Android Head-Units] Kevkos1983:
When I plug in the usb cable and try any basic usb connections like phone chargers usb sticks etc. Nothing happens at all.

I've attached a screenshot from a product guide I found online if that helps.

If anyone knew which pins were for data transfer or voltage, that could help me loads.

Thanks
[Android Head-Units] rigattoni:
Measuring is the magic word. 8 pins will be connected in the original cable. (VBUS)+5V 2 times and 2x GND

...then you only have to find out what is D- and what is D+ for the data lines.

If you don´t want to measure: Open the magic box and have a look at the pins from the connector inside.

Just with your picture no one can tell anything. Each supplier does it´s own magic.

By the way... Connecting that wrong, may damage the internal USB-Hub and you can buy a new mainboard... just to mention. Trying around is not a good idea.
[Magisk] Dark Vanitas:
Hello guys I recently rooted my xz premium dual sim and I currently have Magisk 22.1, I'm not an expert so

I need help please, what are a proper direct way to get xposed working properly on Android 8.0 ROM?

I mainly need to install XPrivacy, I tried to install EDXposed but it failed though and I'm not sure what to do

Thanks in advance
[Magisk] CookieCream:
Since you need to install this with Magisk, do this:

Donwload the attached files

be sure to install the Xposed Magisk apk file first and open it it will show, thats it's not installed

then go to magisk and flash the xposed framework zip

and reboot

then (after your device is completely started with magisk and xposed) go to magisk, and check if the module's enabled. If it's NOT enabled, flash the zip again. If it's enabled, open xposed installer and check. (it's still not fully installed) and then there comes a message, that it's installed, but not really.

For the last step you need a custom recovery (like twrp or something)

Boot into your custom recovery and flash the xposed zip there (again)

Reboot and enjoy.

Another (way simpler) method would be to download it from magisk manager (if you have a older version) online repo.

I attached the Magisk version (with working repo)
[Magisk] lemon567:
In case xposed is installed but remains not active (yellow triangle instead of a green checkmark in the xposed installer app) follow the instructions of post #2 and don't worry you don't have to be an expert for this fix its fairly easy

https://xdaforums.com/t/magisk-xpos...-not-active-xposedbridge-jar-lacking.4204875/
[OnePlus Nord N200 5G] bebop831:
Hello!

So, recently I've been getting very involved in cyber security, specifically pen testing. I had seen somewhere that one could install a type of kali linux on their rooted phone? Now, I'm familiar with the rootless nethunter install with termux. I was wondering if there is a custom rom avaiable for the N200 5g? Any info would be appreciated.
[OnePlus Nord N200 5G] 78t140@broadstripe.net:
i successfully installed kali nethunter on my rooted n200 look on ebay and type in subject line item # 284845689370
[OnePlus Nord N200 5G] garth788:
No results found on ebay
[OnePlus Nord N200 5G] sundigen:
hey man dont go paying money for something tou can get for free. all you have to do is root your phone put lineage on it if you want. then go to the kali website and download the nethunter stuff. i everything is explained on the website on what to do.
[OnePlus Nord N200 5G] TheFilthyMongol:
I am trying to install NetHunter on mine. So far I have not been able to flash the Universal DM-Verity, ForceEncrypt Disabler. Any idea on how to do it on this phone without the recovery partition?
[OnePlus Nord N200 5G] X_shinobi.apk_X:
theres alot of confusion with that universal dm-verity thing. dont use it. get your vbmeta img and boot to bootloader open a cmd prompt in the directory of your vbmeta img then try

fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img

or simply download fastboot enhanced gui and flash the img thru that, it will prompt if you want to disable it

[TOOL][Windows] Fastboot Enhance [Payload Dumper & Image Flasher]

Fastboot Enhance What it can do? - Show fastboot vars - Switch between fastbootd & bootloader - Switch between A & B slot - Flash Payload.bin in fastbootd - Flash images - Erase partitions - Delete logical partitions - Create logical partitions...

xdaforums.com
[Vivo X Fold] Q-Prof:
Background:

I am located in Canada running a old import( 2016), Huawei Honor Note 8 which I really have liked - screen 2560*1440 and hardware quality running the EMUI & Android ver 8 and last security patch Jan 2021, with the last year, l lost Google account access as Google or the phone itself won't allow account authentication from it no longer, which is an ecosystem that I use personally and also need for work - Google Classroom (teacher). i.e. no access to Google play and or their services now, plus I have to re-initiate some apps from minimizing/crashing ., so....

Looking at the Vivo X fold as a possibility (also the Sam Fold 4). I know the hardware is far superior compared to other foldables and I like the quality and front screen size of the Vivo X Fold.

Aware that the software is not going to work without tweaks and fiddling around in some cases, so I am on the fence with this at the moment. I am waiting to see what the Samsung Fold 4 has to offer, but suspect it will not change much from the fold 3, short of SOC update, camera update, hinge update, inside screen film thickness improvement to 60 microns, slight size update for the better, from leaks.

Meanwhile, knowing Vivo X Fold is a Chinese import (software isn't going to work 100% which I can live with and understand from my current phone), my biggest concern is multi-tasking looks very weak from reviews I have seen it compared to the Fold 3, with the Mate X being the best, but it doesn't have Google services which I need - so hence software and multi-tasking will be better on the Fold 4 with s-pen, BUT screen size and hardware quality is a BIG negative for me in comparison to the Vivo X Fold.

Questions:

Hence the reason why I am on the fence with the Vivo X Fold. Vivo claims 3 years of updates and so maybe they update, fix, and improve the multi-tasking but it may never get fixed, nor does it look like there will be a global version put out at this point - am I right, and has Vivo in the past been good with update improvements after phone is released?

Any of you that are currently using the Vivo X Fold here in America as a main driver phone have any further thoughts on - if this Vivo X fold is the best foldable option, as the Samsung fold 4 I suspect is not going to be much of an improvement (size/quality) when it is announced Aug 10?

Also, on the Vivo X Fold, has anyone successfully used the Alexa App for smart home control, I assume this will work with the Chinese ROM like most other apps right - anyone confirm this?

As for purchasing the Vivo X Fold, I have read here, that Wonda ships really quick (less than a week to Canada) and also heard good things with Gizpro but 20 days to get, so maybe Wonda is the best option (currently a little cheaper too, about $50), any further thoughts?