yashsingh1/xdaforums huggingface dataset:
[Xiaomi Mi 11 Ultra] krepsz:
Try it more times to flash the original boot.img from the V13.0.4.0.SKAMIXM rom. If no result, than you have to try first dirty flashing the rom. If dirty flash not working, than last chance is clean flash.
[General Questions and Answers] rob4444:
Hi guys,

I have a big issue with my Samsung Galaxy A21s. I set up a password for the lock screen a couple of days ago. Everything was working fine, but yesterday my phone randomly decided to lock itself for 1440 minutes (24 hours) after typing in my correct password once. I waited those 24 hours and tried again and it got locked for another day again. The password is 100% correct.

Or course I tried restarting the phone and booting it in safe mode, without success. I tried unlocking it on my computer via Google find my phone (I don't have a samsung account set up), but it appeared as offline, even though it is connected to wifi. I have to mention that it has airplane mode on which I can't turn off and NordVPN is installed. The phone has very few apps installed, such as Telegram, NordVPN and Instagram, no malicious third party applications...

I don't want to hardware reset the phone because it has very important things on it. Sending it to Samsung isn't possible as well, I don't have a bill for the product.

Please help 😭
[General Questions and Answers] Gotiplex:
Do you have bootloader open ?

If so you can flash a file than break through the password
[General Questions and Answers] rob4444:
what file should I flash? It's very important for me to keep the data.
[General Questions and Answers] Gotiplex:
hum I have it on my other computer so I have to go get it, but can you flash a file now ?

PS : I used this file when the password did not work on my Samsung J5, and it just delete the password
[General Questions and Answers] rob4444:
I wont flash a random file by a random user on the internet. Send me the original download link to the file or something...
[General Questions and Answers] Gotiplex:
Yes of course, i needed to find the file to remember its name...

It s called Lockscreen_FIXER, and it s a126 ko zip file.

I don t have the source, but check this on internet
[General Questions and Answers] Gotiplex:
https://xdaforums.com/t/zip-lock-screen-fixer.2799377/
[General Questions and Answers] rob4444:
thanks, I would like to try this, although my phone is like 6 years newer than the post... how do I flash it without using my phone? Should I use bootloader or something, can you explain?
[General Questions and Answers] Gotiplex:
That IS why I asked you if you could flash a file.

Did you ever unlocked your bootloader ?

If so, you have to put twrp on your phone (there is many tutorial for each phone in the forum), and then flash the file with your sd card.

If your bootloader IS locked, I don t know how install TWRP recovery, but maybe there is a way on the net.

What is your phone model ?
[General Questions and Answers] rob4444:
Ah okay thank you... Model is Samsung Galaxy A21s
[General Questions and Answers] rob4444:
I dont have bootloader set up and if I understood correctly, setting up bootloader and twrp will erase all data...
[General Questions and Answers] Gotiplex:
Absolutly not, I don t know how to unlock bootloader other than via the parameters, but I doesn t erase any data, same for TWRP.

Find a way to unlock the bootloader, then just install TWRP with Odin, and then you just have to flash the file.
[Windows Mobile Development and Hacking General] td5guy:
With Theme Maker you can create or capture any image and use it as your Windows cursors, icons or desktop wallpaper.

Any Image can be captured. For cursors and icons, you can even add transparent areas using the editor. Just drag and drop the new image on to the cursor you wish to change, then add wallpaper and sounds to complete the desktop theme.

Themes can be saved as zip files or self installing exe files. Themes can also contain

winrar:

http://www.rarlab.com/download.htm

download
[Windows Mobile Development and Hacking General] ingerasu:
screenshot please :D
[Huawei Watch] firstmoon:
Hello I have a theme that shows sunset and sunrise times. I also created a custom one for myself with facemaker, but I can't add sunset and sunrise times. Anyone know how I can do this?
[Huawei Watch] mreps07:
( ( {dtp} * 360 ) + 155 ) % 360

try that code..it works with watchmaker app
[Touch Pro, Fuze Themes and Apps] xiaoan:
I am starting a thread to collect all softwares that is already been tested and working on a VGA windows mobile 6.1 or a Raphael.
[Touch Pro, Fuze Themes and Apps] techieinpink:
Tested software for TP

Hi xiaoan! I applaud you for starting this thread. Here are software which I have already tested to be working on my TP:

1. SpoonDo - this is a freeware tasks manager/to do program that works with your TPs existing tasks.

2. Agenda One - it works beautifully except for one thing. When you switch to landscape mode while writing a task or appointment, you cannot see the text your typing on the screen. You would have to switch to portrait mode to check if you typed everything correctly.

3. Agenda Fusion - works perfectly and flawlessly. It's what I'm using with my TP now.

4. Pocket Informant - did not encounter any errors when I tested with my TP

5. PowerSMS - works great with the TP. In fact, images of the software in action at the developer's web site are shown running on a TP.
[Touch Pro, Fuze Themes and Apps] -jordann:
doesn't most windows mobile apps work on the raphael anyway?
[Touch Pro, Fuze Themes and Apps] DeepThought:
In my experience it does. I'm even using a 5 year old ip calculator which was originally written for wm2003 - and it's working perfectly.
[General Topics] Renate:
The Qualcomm XBL (SBL1) and Firehose loader images are packed somewhat reasonably.

They are ELF images (32 or 64 bit) with no sections but 3 or more programs:

E:\>elfview xbl /p
# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 960 000000 00000000 // this is the standard ELF header
1 null 6952 001000 9fdb6000 // this is the signing
2 load RX 350012 003000 14015000 // these are various things that actually get loaded
3 load RWZ 0 058740 14077000
4 load RW 31844 058740 1407a000
5 load RWZ 0 0603B0 14084800
6 load RWZ 0 0603B0 85e00000
7 load RX 11824 0603B0 146ae000
8 load RW 2916 0631E0 146b1000
9 load RWX 107032 063D50 14098000
10 load RWZ 0 07DF70 146b2000
11 load RWX 1792000 07DF70 9fc00000
12 load RX 78208 233770 14699000
13 load RX 171536 2468F0 85e35000
14 load RW 6409 270700 85ea8000
15 load RWZ 0 272010 85e97000

That is to say:

32 bit ELF file
Program table
Signing
Header
Hashes // one for each program, the 2nd is zeroes as you can't hash the hash!*
Signature
Certificate chain
Payload // multiple programs

So the XBL loads the next one, usually abl which is the Android bootloader which also implements the fastboot protocol.

Now we get a bit deep in the gumbo:

E:\>elfview abl /p
# Type Flags Size Offset Address
-- ------- ----- ------- ------ --------
0 null 148 000000 00000000 // this is the standard ELF header
1 null 6536 001000 9fa22000 // this is the signing
2 load RWX 139264 003000 9fa00000

32 bit ELF file
Program table
Signing
Header
Hashes
Signature
Certificate chain
LZMA archive
MZ Windows executable
PE Portable executable
64 bit ARM code

This is all (U)EFI compatibility so it has sworn fealty to Intel/Microsoft.

So, accepting all the idiocy of this, my question remains:

7-Zip can extract the structure of what is the #2 (i.e. the third) program:

C:\>7zip ablefi
Type = UEFIf
ERRORS:
Headers Error
Physical Size = 139264
Method = LZMA

Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
D.... 9E21FD93
D.... 9E21FD93\EE4E5898
..... 0 9E21FD93\EE4E5898\0.raw
D.... 9E21FD93\EE4E5898\VOLUME
..... 20 9E21FD93\EE4E5898\VOLUME\FFFFFFFF
..... 376832 9E21FD93\EE4E5898\VOLUME\LinuxLoader.efi
------------------- ----- ------------ ------------ ------------------------
376852 139264 3 files, 3 folders
Errors: 1

The "program" itself starts with 16 bytes 0x00.

If I remove these 16 bytes then 7-Zip can't decypher the file.

The ultimate question is that while I can trivially reverse engineer the actual abl and modify it so that "orange state" doesn't wait 30 seconds when rebooting, how can I LZMA-ish pack the modified results so that it's acceptable?

LZMA normally has a 13 byte header. Why does this all start with nulls?

*Please note that although you can't hash the hash, you can Can the Can
[General Topics] Renate:
@Appreciative

Sorry, I don't have anything technical documents on this at all except for Qualcomm stuff at the level of a PowerPoint.

All that stuff from booting onward is non-disclosure aggreement restricted.

I think that SecureBoot is in a OTP (one time programmable) fuse, but I don't know.

I can monitor the hardware console while booting the Firehose loader:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.4-00246-S660LZB-1
S - IMAGE_VARIANT_STRING=Sdm660LA
S - OEM_IMAGE_VERSION_STRING=cibuild
S - Boot Interface: Unknown
S - Secure Boot: Off
S - Boot Config @ 0x00786070 = 0x000001c1
S - JTAG ID @ 0x00786130 = 0x000cc0e1
S - OEM ID @ 0x00786138 = 0x00000000
S - Serial Number @ 0x12345678 = 0x12345678
S - OEM Config Row 0 @ 0x00784188 = 0x0000000000000000
S - OEM Config Row 1 @ 0x00784190 = 0x0000000000000000
S - Feature Config Row 0 @ 0x007841a0 = 0x007030000b580100
S - Feature Config Row 1 @ 0x007841a8 = 0x00000000000000c0
S - Core 0 Frequency, 3715 MHz
S - PBL Patch Ver: 5
S - I-cache: On
S - D-cache: On
B - 0 - PBL, Start
B - 7024 - bootable_media_detect_entry, Start
B - 141363 - bootable_media_detect_success, Start
B - 141369 - elf_loader_entry, Start
B - 19372540 - auth_hash_seg_entry, Start
B - 19372841 - auth_hash_seg_exit, Start
B - 19481121 - elf_segs_hash_verify_entry, Start
B - 19534026 - elf_segs_hash_verify_exit, Start
B - 19534831 - auth_xbl_sec_hash_seg_entry, Start
B - 19563960 - auth_xbl_sec_hash_seg_exit, Start
B - 19563963 - xbl_sec_segs_hash_verify_entry, Start
B - 19570674 - xbl_sec_segs_hash_verify_exit, Start
B - 19570719 - PBL, End
B - 0 - SBL1, Start

I've also pieced together some addresses from logs and dumping the DTB:

00780000 msm-core
00780350 secure_boot
00784138 serial_number
00784188 oem_config0
00784190 oem_config1
007841a0 feature_config0
007841a8 feature_config1
00786040 jtagfuse
00786070 boot_config
00786130 jtag_id
00786138 oem_id
[General Topics] Yahoo Mike:
Nice work. This saved me days of hard work.

Did you ever find a solution to this re-pack problem? I'd like to do something similar for the bootloader on my tablet.
[General Topics] Renate:
Nope, I havn't gotten back to this yet.

I guess it's just a question of biting the bullet and diving into this swamp of stupid packing.
[General Topics] Yahoo Mike:
After a bit of research, I can answer that question.

It starts with nulls because it's not an LZMA header. It's a UEFI Firmware Volume (FV) header, in which the first 16 bytes are always zero.

I looked at a few UEFI FV editing tools, but none of them do quite what we want. So I've started on my own. I'll keep you posted on progress.

Here's a summary of my research:

The layout of a UEFI Firmware Volume
====================================
see: UEFI Platform Initialization Specification, Vol. 3 (https://uefi.org/specifications)
see also: https://sudonull.com/post/125061-UEFI-BIOS-file-device-part-two-UEFI-Firmware-Volume-and-its-contents

+----------------+----------------+
| | FV Header |
| |================|--------------------+-------------------+
| | | | FF Header |
| | | |===================|---------------+
| | | | | FS Header |
| | | | FF Section (FS) |===============|
| | | | #1 | data |
| | | Firmware File (FF) | | |
| | | #1 |-------------------|---------------+
| | | | . . . | . . .
| | | |-------------------|
| | | | FF Section (FS) |
| UEFI | Firmware | | #N |
| Firmware | File |--------------------|-------------------+
| Volume (FV) | System (FFS) | | . . .
| | | . . . |
| | | |
| | |--------------------|
| | | |
| | | Firmware File (FF) |
| | | #N |
| | | |
+----------------+----------------+--------------------+

To implement this, an object model might look like this:
* a FirmwareVolume object has 1 FirmwareFileSystem
* a FirmwareFileSystem has 0..n FirmwareFile objects
* a FirmwareFile object has 0..n FirmwareFileSection objects

Just to make life interesting, one type of FF Section is the EFI_SECTION_FIRMWARE_VOLUME_IMAGE.
It has a UEFI Firmware Volume as its data. So there can be FVs nested in other FVs ad infinitum.

FF Sections can also be encrypted, compressed or encoded by an OEM.
Once decrypted/decompressed/decoded, these sections contain further FF sections.

And in accordance with Murphy's Law, the file we want (LinuxLoader.efi) is in one of those nested firmware volumes. ...And you guessed it - the nested FV is compressed using LZMA. Presumably that's deliberate - so you can't directly edit the bootloader in the abl.elf.

So I plan for my tool to do two things:

extract the LinuxLoader.efi file from the abl.elf file

repack a modified LinuxLoader.efi back into the ELF file.

I don't know if a repack will work. There are some checksums in the EFi headers. And the whole ABL.ELF might be signed by a private RSA key and the SoC will refuse to load it without the correct signature. We'll see..
[General Topics] Renate:
Well, that's very clever of them. Most standards use "magic" values in the header.

These guys have taken a bold stand: "When you see 16 0x00 it's an unambiguous sign that you've found our UEFI FV!"

<rant>

I've dealt with kernels that were uncompressed, compressed with gzip or compressed and a decompressor stub.

So, imagine my surprise when I ungzipped a kernel from a boot image recently and found that it starts with "MZ".

"OMG, did Bill Gates buy Android? Is this the MS-DOS compatibilty layer?"

No, it's just the MS-DOS header stuck on a Windows PE header stuck on a kernel.

00000000 t _head
00000000 T _text
00000040 t pe_header
00000044 t coff_header
00000058 t optional_header
00000070 t extra_header_fields
000000f8 t section_table
00001000 T do_undefinstr
00001000 t efi_header_end
00001000 T _stext

</rant>
[General Topics] Yahoo Mike:
Yes, very clever. But there is method in their madness. According to the spec: "The first 16 bytes are reserved to allow for the reset vector of processors whose reset vector is at address 0."

There is a bit of magic at byte 0x28 in the FV header. It's always "_FVH". That's how you identify a UEFI FV. But I guess the first 16 nulls are always a big hint.

...and it's great to see that the ghost of MS-DOS lives on. It reminds me of what we used to say in my early programming days: "DOS is boss".
[General Topics] Renate:
I've been looking into this hashing business.

I know that I'm basically on the right track.

I can take a Firehose loader (basically a custom xbl) make a trivial spelling change somewhere and it will refuse to load.

I can recalculate the SHA256, replace it and it will load correctly.

I have a WIP that checks the hashes on xbl/abl/firehose loaders (all basically the same).

I see tons of files that check out 100%.

C:\>qcomview /h poke3.bin
64 bit ELF, SHA256
0 00000000 00000318 a117dbc5 e643e404 361bfe30 45fbda01 4c153842 59a4cbe8 09b7da55 a2dd413e OK
1 00001000 00001ac8
2 00003000 0005709c 7b833734 f2763b9e 35f3310c f6fb22a9 a514eac0 3eddbe46 b5ff339b 3c7b045c OK
3 0005a0a0 00000000
4 0005a0a0 00009f00 6296c006 31852f79 b99691c3 e8d598f2 9d323e9a ba0358aa b742901f 506709d5 OK
5 00063fa0 00009908 41176495 3e07ad84 8923398e ce854131 91066dca 43f253fa c027c4f4 a3c21483 OK
6 0006d8b0 00000000
7 0006d8b0 00001e7c fe77c473 b02e4a71 d3f287e4 cf85ccbe b5a43326 53930bd8 d68e4e40 6e71a0b8 OK
8 0006f730 00000000
9 0006f730 000188d8 1bfef74c ed467a22 8616419d e71ab1ea 22a717e5 4874c704 541793ed f5d5c5e5 OK
10 00088010 00000000
11 00088010 00000000
12 00088010 00012dc0 b72cb77e 81026632 446c3462 cc6c83fc d7904333 cb8807cc 27d6e4c9 189c7ca4 OK

I see a bunch of files that don't check out at all.

I can SHA256 a program chunk and the SHA256 appears nowhere in the entire file.

Are they salting the SHA256 or using a different hash?

Edit: Oh, it looks like SHA512. :( Er, maybe SHA3 512?

Edit: Ok, big deal, so I can't count. It's SHA(2)-384. WIP can be found http://www.temblast.com/qcomview.htm

The SHA256 displays the calculated and verifies.

The SHA384 displays the file content and does not verify (yet). calculated and verifies.

There is also an option to dump an ASN1 listing of the certificate chain.
[General Topics] Yahoo Mike:
qcomview works great. Thanks.

With @Renate 's invaluable guidance, I put together a tool to extract the LinuxLoader from the abl.elf file, and to repack a modified LinuxLoader back into the abl.elf file. But it comes with a warning: don't try to run a modified abl.elf on a device with SecureBoot on - if you do, you will probably brick your device. Of course, if SecureBoot is off, this tool should work for you.

If you want to try it, the tool source is available at: github.com/Yahoo-Mike/lltool. It's still in beta. It was only tested on a limited number of ELF files and it might need some fine-tuning for different OEMs. So feel free to report issues or send pull requests. If it doesn't work on your ELF file, send me a link to the file and I'll see what I can do.
[General Topics] Renate:
Nice work! (And a bunch of it.)

I just got around to modding my abl. I just did it manually.

You just split your abl at 0x3078. The high piece is just the LZMA. You expand/mod/compress and stick it back.

Then you have to pad it nicely, change the size in the program table, fix the signing on program #0 and #2.

And just like that you're done!

It made a world of difference. I got rid of the 30 second delay for being Orange. It seems I waste half a day with that 30 seconds.

Have you got a SecureBoot=off device?

I'm sure many people are getting sick of all the restrictions.
[General Topics] Yahoo Mike:
Spot on!

No, unfortunately. That's why I'm still hunting around for other options. I'm currently thinking about self-signing the modded abl.elf. Maybe I'll get lucky and the OEM allows that on my device...

BTW, I don't suppose you know the answer to this question: How to find "hw_soc_version" for a QCom SOC?
[General Topics] Renate:
Usually the SHA256 of the root CA corresponds to the "Hash" burned into the chip.

I see that's true for about 80% of the loaders in the repository.

There may be a newish wrinkle where there is an encryption step or something.

But if you're SecureBoot, everything has to match all the way down.
[General Topics] Renate:
Some trivia from our favorite loader repository:

Older style, not an ELF [ 89]

32 bit ELF, Version 3, SHA256 [460]
32 bit ELF, Version 3, SHA384 [ 8]
64 bit ELF, Version 3, SHA256 [ 31]

64 bit ELF, Version 5, SHA256 [ 65]

32 bit ELF, Version 6, SHA384 [ 4]
64 bit ELF, Version 6, SHA384 [ 54]

Of course a bunch of these are duplicated and put in different directories.
[General Topics] Renate:
I've got it down to 100% automatic now. It uses a makefile and a few of my "glue" utilities.

hexcalc size(ablmod)-3000 > hexcalc.tmp
[General Topics] cuynu:
My Xperia XZ2 got turned off secure boot after unlocking bootloader, is this actually off? I don't trust secure:no in fastboot getvar secure
[General Topics] cuynu:
I'm wondering if my phone will brick if flashing abl mod
[General Topics] Renate:
It's hard to tell. I don't trust fastboot getvar secure

Still, my not-SecureBoot device says no and my SecureBoot device says yes.

Do you have a Firehose loader for your device? Have you tried EDL on it?

The easiest, safest, bullet-proof way to determine if you're secure is to take a Firehose loader, modify it trivially (spelling on message), rehash it and see if it works.

If it's a standard Firehose loader, just tell me the MD5 and I'll patch it for you.
[General Topics] cuynu:
Unfortunately, there is no firehose loader for Xperia XZ2 nor sony phones
[General Topics] cuynu:
I can get to EDL by short testpoint in the mainboard, but the PID not 9008, it is PID:ADE5
[General Topics] Renate:
Mmm, that seems strange.

Because the VID/PID comes out of the ROM PBL and I've never seen any override on 05c6/9008.

OTOH fastboot often has wacky VID/PIDs.

Look at the manufacturer/product strings and see if it's Qualcomm CDMA Technologies MSM and QUSB__BULK.

https://www.ftdichip.com/Support/Utilities.htm#MicrosoftUSBView
[General Topics] cuynu:
When I connect EDL and press lsusb, it recognizes as Sony Ericsson Mobile Communications AB QUSB_BULK.
[General Topics] Renate:
Well, then I'm wrong. For the first time ever. Today. But it's still before 8 AM. :p

Ok, have you ever used the Python EDL client from bkerler? https://github.com/bkerler/edl

You'll have to install the dependencies.

You'll also have to patch edlclient/Config/usb_ids.py and add your VID/PID to default_ids.
[General Topics] cuynu:
I have installed edl tool from bkerler, this is what i get from that tool
[General Topics] Renate:
You can't load an abl with EDL.

Theoretically you should be able to load a xbl/sbl, but I've only gotten errors.

You need a Firehose loader.

Going by your numbers I don't see that that GitHub has a Firehose loader with your signing.

OTOH, if you're really not SecureBoot then a loader with different signing will work.

Try these in the GitHub:

blackshark/0008b0e100010000_acb465293769a1c7_fhprg.bin
lyf/0008b0e100010000_dd7c5f2e53176bee_fhprg.bin
oneplus/0008b0e10051459b_dd7c5f2e53176bee_fhprg_op6t.bin
samsung/0008b0e100010000_82ddd92611bdfac8_fhprg.bin
samsung/0008b0e100010000_a20f3e22ee2a58da_fhprg_peek.bin
xiaomi/EDLAuth/0008b0e100010000_c924a35f39ce1cdd_fhprg_edlauth.bin
xiaomi/EDLAuth/0008b0e100720000_c924a35f39ce1cdd_fhprg_edlauth_poco_f1.bin
[General Topics] cuynu:
I tried blackshark and op6t, it just stuck at uploading loader... This means secure boot is still enabled?
[General Topics] Renate:
Not necessarily.

One of the problems is that single Firehose loaders are made for multiple SoCs

Try the four loaders in this directory: qualcomm\factory\sdm845_sdm850_sda845

It's also important to differentiate loaders that load but don't run and loaders that don't load.
[General Topics] cuynu:
I also tried, but its only stuck at uploading loader
[General Topics] Renate:
If you've tried a bunch and they've all died at ~10% loading then I'd suspect that the signing disagrees.

All that stuff is at 0x1000, so early.

So, I'd suspect that you were SecureBoot.

OTOH, if it were a case of memory map difference it could fail almost that early too.

Sony is a big-ish company and I don't suspect that they'd leave SecureBoot off.

They seem to be tight-fisted with their Firehose loaders.

I see only one Sony Firehose loader and it looks old.
[General Topics] Yahoo Mike:
Yes, deep down I know you're right. But hope springs eternal...
[General Topics] cuynu:
Yeah, that why my Xperia XZ2 still bricked till now, after flashed wrong abl file from LG G7 ThinQ.

..main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara -
------------------------
HWID: 0x0008b0e100010004 (MSM_ID:0x0008b0e1,OEM_ID:0x0001,MODEL_ID:0x0004)
CPU detected: "SDM845"
PK_HASH: 0xc8d92a2dba1482588eff712963329500ac7155cea8494fdd4b7b180f2f871801
Serial: 0xf7d8400f