yashsingh1/xdaforums huggingface dataset:
[Xiaomi 12S] b4mb1_:
Hi, I'm thinking of buying this phone (upgrade from my POCO F3) - I have a bunch of questions if someone could please answer these, thank you!

Bugs?

Does the FP sensor with tempered glass protection?

Camera Quality/Night Mode? (sorry I'm only seeing a handful of 12s reviews) if you could also post some sample shots, please.

Update commitments? Open source? Last I checked, there's still no commitment from an XDA article

GCAM - I saw a bunch of apps on some Telegram group which is dedicated to the 12S series, wonder if you guys tried it yet? (to those who's gonna ask here's the thumbnail & TG link)

RAM management - (I know this will eventually be fixed on custom roms or MIUI EU - will we even have custom ROMs?) but I saw on YT reviews that it has bad ram management

Battery Review - SOT? WiFi/Data

Any official Telegram channel yet? 12S Photography? - All I can see is 12S Ultra

Overall, how does it feel? A good daily driver? I had Mi 8 before and switched to F3 (camera sucked so hard compared to Mi 8) even with GCAM, so basically I'm looking for something bug free, daily driver + good cam.

Thank you guys!
[Xiaomi 12S] Nicknackpaddywack101:
Hi. I use my Mi12s as a daily driver. Here are my thoughts.

With stock Chinese rom it is pretty stable, but even for this price tag you are getting Ads and Bloatware so naturally I would want to flash a custom rom. However this device is still fairly new (although Xiaomi seem to have moved on with the 13) and it is a China-only model so You either have to flash a GSI and risk things not working or you have to use third party apps to debloat the device and risk deleting or disabling system apps that make your device brick after a restart (which would mean a factory reset or else a complete MIflash system reset) so you are probably better off with one that has international support. I actually recommend an older model such as the 11 or 10 as they still have plenty of support but they are in enough hands that pixelexperience and LineageOS all support it.

xiaomi.eu now has a rom for the 12s you can use if you like. I have not tried it out yet.

The system adds 3GB of virtual memory to the device by default. This affects storage and will wear out storage faster so I choose to turn it off.

There is no support for multiple users, but there is a feature called second space which basically does that (found out in adb)

And I do not think there is an official way of getting this device outside of China. On top of that I do not think warranty can be used outside of China since this is a China-only device.

Post in thread '12S in EU ??' https://xdaforums.com/t/12s-in-eu.4474521/post-87927865
[Realme 8 Pro] Jawor245:
Hello there :)

Is there any way to manually download ozip file for update from c.19 to c.20 gdpr variant?
[OnePlus 7T Questions & Answers] savage44:
Hi

After https://onepluscommunityserver.com/ is down, I need unbrick tools, MSM, etc. for OnePlus 7T EU. I found a firmware somewhere on the internet, androidsage probably. Unfortunately I can't find any MSM Tools to unbrick (restore to stock) my phone. Maybe anyone have those files and can upload it? Thanks :)
[Samsung Galaxy S22 Ultra] shaolin95:
Hi.

My ultra is unlocked and I'm currently in Europe when this update option showed up. Should I allow it? I am just not sure if updates are based on location and it's going to mess things up when I get back to the USA.

Thanks
[Samsung Galaxy S22 Ultra] KOLIOSIS:
What firmware are you currently using?
[Samsung Galaxy S22 Ultra] shaolin95:
Thanks
[Samsung Galaxy S22 Ultra] KOLIOSIS:
Both have the same product code (USC), so, it appears it's just your usual monthly update.

It's USA firmware.......

https://www.sammobile.com/samsung/g...M-S908U1/USC/download/S908U1UEU2AVG8/1664686/. (July 2022)

https://www.sammobile.com/samsung/g...M-S908U1/USC/download/S908U1UEU2AVHF/1674713/. (August 2022)

Just curious......

You said this was unlocked, I'm guessing you mean SIM unlocked. Is this a carrier model (that's been SIM Unlocked) ?
[Samsung Galaxy S22 Ultra] shaolin95:
Sweet. I got it from Samsung directly trading in my 21 ultra. Unlocked.. no carrier for this one.

Thanks!
[Redmi Note 11 (spes/spesn)] sph21:
I succeeded in unlocking my phone's bootloader.

I enabled usb debugging.

The problem is when the phone is on, my pc can detect this device when I entered 'adb devices' in powershell/ cmd.

But when I entered fastboot, my pc is unable to detect the device whenever I entered 'adb devices' in powershell/ cmd.

It baffles me because I have never encountered this problem before. I had successfully installed twrp recovery on other phones in the past.

On device manager, it shows Android Phone -- Android Bootloader Interface when I connect the phone in fastboot mode. When I boot it, under Universal Serial Bus devices, it shows Redmi Note 11.

I used Google's SDK Platform Tools from here by following this method to install it.

I'm using windows 10 x64 21H2 with latest update.

My phone is spesn.

How do I fix this problem in order to be able to install TWRP recovery?
[Redmi Note 11 (spes/spesn)] Vagelis1608:
Have you tried using "fastboot devices" while in fastboot mode, instead of the adb one?
[Redmi Note 11 (spes/spesn)] sph21:
Entering "fastboot devices" detects my device.

But when I entered "fastboot flash recovery twrp-3.6.2_12-0-spes-Jabiyeff.img", I get this error:

Edit:

I fixed it by following this guide and managed to install twrp properly.

Thank you @Vagelis1608 for your help earlier.
[Redmi Note 11 (spes/spesn)] Vagelis1608:
Yeah, on AB devices you need to boot the recovery and flash it through there.

Good to see you figured it out though.
[Redmi Note 11 (spes/spesn)] ZERK0:
redmi note 11 doesnt have recovery partition,you need to use command fastboot flash boot ...
[General Topics] User154:
Admin: Please move/delete this thread if it is in the wrong place or against the rules.

I wanted to create a thread to discuss unlocking fastboot mode on Oppo devices in general, rather than discussing it in terms of any one device in particular. The reason being is that there are currently little bits of information scattered here and there across various different device forums. I think it would be useful to have somewhere where we could pool our information on the subject.

I will say at this point, I'm not sure what progress can be made, but I do think we could answer some of each other's questions and build a bigger picture of what is going on.

One question I have for example, that I know someone out there will know, or be able to test, is if you have enabled engineer mode with the sec5 app, or otherwise, are you then able to invoke methods from the 'android.engineer.OplusEngineerManager' class without getting an selinux error?

I have decompiled the deeptesting app and looked through the sources a little and found the method that unlocks fastboot mode. Its signature is as follows:

fastbootUnlock(byte[ ] bArr, int i)

The byte array is essentially formed as followed:

a string is split into pairs of characters,

each pair is a hex code that is converted to an int,

the byte value of each of these integers is then stored in a byte array.

The int that the fastbootUnlock method takes is simply the length of the byte array.

I have a find x3 pro and have hit a bit of a brick wall in testing in that I cannot invoke methods from the 'android.engineer.OplusEngineerManager' class however I do suspect that with engineer mode enabled it may be possible to invoke methods from this class.

If you have any information you feel may be relevant, any questions, or even just want to say hello, do not hesitate to post 🙂
[General Topics] User154:
So, no major breakthroughs to report but some stuff that may be of use to people.

After hitting a bit of a brick wall disassembling the deeptesting and engineermode apks I have turn my attention to the system.

Both these apks rely on custom services implemented by oppo (Although most files relating to them have oplus in the name)

After loading up one of the service files 'vendor-oplus-hardware-engineer@1.0-service' in ida I think I can see that the key required to unlock fastboot mode is stored on the odm partition in /odm/etc/DownloadModeKey/ (This is a little over my head but I can see multiple references to this)

Also I have found an xml with a list of mmi codes, I don't know how much use it will be to anyone, but there are a couple in there that I dont believe have been documented elsewhere, so I will upload it here
[General Topics] super5at:
I did some very cursory reverse-engineering of the deeptest app and basically came to the conclusion that it depends on the response from Oppo's servers. In a properly designed system (which the original Danger hiptop/T-Mobile Sidekick implemented) there's an unlock entitlement cryptographically signed by the OEM. I *assume* that's the case here, but I don't know for sure.
[General Topics] User154:
Getting the correct response from Oppo servers allows the app to invoke the fastbootUnlock method however I believe the key required for the method is stored on device.

From my point of view, the biggest, and perhaps only remaining, hurdle is being able being able to invoke methods from the OplusEngineerManager class from our own apps.

I know the method required and and what parameters should be passed to it. I strongly suspect from reverse engineering the engineer service the key is stored on device. This key is then seperated into pairs of digits and convertered to a byte array. The fastbootUnlock method takes 2 parameters, the byte array and an integer that is equal to the length of the byte array.
[General Topics] wizard8400:
Hi! I'm trying a different approach, to spoof the device model so that the deep test.apk will do its thing.

I have the realme gt 2 (EU) RMX3311 that can't be unlocked but the Indian version (RMX3312) can be unlocked. Some guys managed to change the region of the RMX3311 to India and the deep test apk allowed the bootloader to be unlocked. So, from what I've read, deep test reads build.prop and if it finds the right model it communicates with realme backend to receive the unlock code, and everything works...

Now I'm trying to find in the deep test apk when it reads the device model and change that code so it accepts whatever it finds :) The problem is I can't understand smali source code :))
[General Topics] User154:
Hi! You might find it easier to understand the flow of the app if you decompile to java, the output won't be compilable but you could pinpoint where the region is checked and cross reference that to the smali code you have, you could at least get some idea of where to start.

I will say, if a modified version of the app can still access the OplusEngineerManager class without an selinux denial, then you could probably just get your download mode key by doing a dump of your device in edl mode and then modify the app to call its fastbootUnlock method with the key from your dump.

I haven't tested this because on my find x3 pro I can't even install the deeptesting app.

I haven't tried to do much in a while because I've gotten a bit stuck trying to work out how to calculate the secrecy token. I am not great with C and trying to understand decompiled pseudocode is a little bit beyond me lol. Quite disheartening too knowing that even if it was possible to work out that token by disassembling system services, it still might not mean I was able to access the OplusEngineerManager class.
[General Topics] Unf59:
Luddite I be. Tired and couldn't workout how to cancel a post
[General Topics] burhanhanzada199888:
https://xdaforums.com/t/kernel-source-and-device-tree-released.4534491/
[General Topics] User154:
Always great to get a notification for this thread 😀

The release of the kernel sources for the Find X3 Pro is slightly old news, sadly I don't think there is much to be found in regards to unlocking the bootloader or engineer mode.
[General Topics] User154:
Secrecy/Engineer mode unlock possible (For a limited time), for more info please see here:

https://xdaforums.com/t/secrecy-unlock.4365059/post-87919303
[General Topics] User154:
Small update:

Decided to try and pull the DownloadModeKey from my Find X3 pro via adb, the operation was a success but sadly it just looks like an RSA public key so not much use.
[General Topics] xuanhoang1811:
Continue work bro
[General Topics] serv0id:
Hi there,

I have reverse engineered the process deep testing apk does and recreated it independently of the phone.

Suppose I have the "token" which is sent as a byte array to android.engineer.OplusEngineerManager method fastbootUnlock, what will that achieve, except the unlock ofcourse?

I am new to the oppo ecosystem and trying to understand what powers this engineerMode has.
[General Topics] User154:
So I don't actually know for sure what else that method would do, but I can't imagine it would do much else. The OplusEngineerManager class contains multiple methods that do different things, from what I could see most of them are not called by the deeptesting app at all I think I have found the library that the OplusEngineerManager class calls but I'm not 100% sure.

Have you got the token?
[General Topics] User154:
Hi, sorry I only have chance to write a quick reply, I had a similar headache trying to extract the system files 🤣

I did manage to do it in the end, and I can unlock engineer mode on my find x3 pro, if you want any specific files, pm me and I'll send then over
[General Topics] User154:
What files were you looking for? I think the apk makes calls to the service I mentioned in OP I have had a look in IDA but I am not so great at understanding the pseudo code so have not gotten very far
[General Topics] xuanhoang1811:
How about the unlock bootloader ?
[General Topics] User154:
This requires firstly the code which I do believe has to come from Oppo/Realme/whoever. The code stored on the device is an RSA key that the code is presumably checked against.

If someone manages to work out how to get code from Oppo unofficially then we need a way for an app to invoke the fastbootUnlock method from a custom app.

I haven't done much on this recently, I have been working on other projects, sorry.
[General Topics] DRS_Frizzy:
Hi just wanted to say that it's nice to hear that some people try to unlock Bootloader on OPPO Qualcomm i thought that everyone accepted that it's not possible to unlock it and if you didn't know there is app called APKTool M you can read some root files with this app like this DownloadMode key and I can install Depp Testing app but I get this error:

View attachment 5873825

For extracting firmware maybe you can putting phone to EDL and extracting firmware with Qualcomm Softwares as said we can use ApkTool M to read some root files but not all I attach Deep testing file that worked for me here and site from where I got it:https://www.oppo.cn/thread-397164526-1
[General Topics] DRS_Frizzy:
Btw my phone is OPPO A74 4G 12.1 ColorOS
[General Topics] User154:
This is quite interesting, until now I had 2 different deeptesting apks.

V1.01 installs but doesn't do much else

V1.10 does not install as conflicts with another package.

The apk you uploaded is also V1.10 but does install, I get the same screen as you.

For extracting firmware via edl you may be able to use

GitHub - bkerler/edl: Inofficial Qualcomm Firehose / Sahara / Streaming / Diag Tools :)

Inofficial Qualcomm Firehose / Sahara / Streaming / Diag Tools :) - bkerler/edl

github.com

but I have not tried
[General Topics] linccracker:
Could this be modified to work with oppo phones not realme .

GitHub - turistu/rmx3474-rooting: rooting the Realme 9 5G rmx3474 phone

rooting the Realme 9 5G rmx3474 phone. Contribute to turistu/rmx3474-rooting development by creating an account on GitHub.

github.com
[General Topics] DRS_Frizzy:
Already tried but didn't work
[General Topics] wizard8400:
It's working for Realme GT2 GDPR (EU). I've unlocked the bootloader a few days ago. Check this: https://xdaforums.com/t/unlock-bl-on-realme-gt2-rmx3311-gdpr.4585749/
[General Topics] linccracker:
i know as it is it doesnt work for oppo phones , But maybe someone could modify the patch script to make it work .
[General Topics] DRS_Frizzy:
I tried it with other person but we didn't found something useful you can modify it of you want using MT Manager apk or softwares on PC
[General Topics] melontini:
Hi, this might be an obvious question, but has anyone tried decoding their DownloadModeKey using the unlock key sent from realme's (now dead 😍) servers?

I've backed up the key from the server, but it appears too long to decode the DownloadModeKey. Although it might be encoded/salted.
[General Topics] melontini:
So I've also decided to take a look at 'vendor-oplus-hardware-engineer@1.0-service`

As established above, this service reads the rsa public key from odm, but there's also `get_cdk_key_from_reserve` which reads the key from (oppo/oplus)reserve1.

readDownloadModeData is the only method which uses get_cdk_key_from_reserve and get_cdk_key_from_odm. (inside the service)

snippet:

char *v3; // x1
char *v4; // x1

if ( (vendor::oplus::hardware::engineer::V1_0::implementation::get_cdk_key_from_reserve(
(vendor::oplus::hardware::engineer::V1_0::implementation *)s,
v3) & 1) != 0
|| (vendor::oplus::hardware::engineer::V1_0::implementation::get_cdk_key_from_odm(
(vendor::oplus::hardware::engineer::V1_0::implementation *)s,
v4) & 1) != 0 )

After this statement, the method tries to access the reserve1 again, where it reads a JSON file?!

LABEL_17:
Json::Value::~Value((Json::Value *)v23);
return v8;
}

readDownloadModeData is called by readDownloadLoginMode, which is called by readEngineerData.

readEngineerData is a massive switch statement. readDownloadLoginMode is called when the case is 1000057.

What's interesting, is that the char (array?) doesn't seem to be used by readDownloadModeData despite being passed as an argument. It's used by readDownloadLoginMode to run a loop.

v4 = (char *)operator new(0xB1uLL);
*a1 = v4;
a1[1] = v4;
a1[2] = v4 + 177;
do
{
*v4 = 0;
--v3;
v4 = a1[1] + 1;
a1[1] = v4;
}
while ( v3 );
v5 = operator new[](0xB1uLL);
*(_OWORD *)v5 = 0u;
*(_OWORD *)(v5 + 16) = 0u;
*(_OWORD *)(v5 + 32) = 0u;
*(_OWORD *)(v5 + 48) = 0u;
*(_OWORD *)(v5 + 64) = 0u;
*(_OWORD *)(v5 + 80) = 0u;
*(_OWORD *)(v5 + 96) = 0u;
*(_OWORD *)(v5 + 112) = 0u;
*(_OWORD *)(v5 + 128) = 0u;
*(_OWORD *)(v5 + 144) = 0u;
*(_OWORD *)(v5 + 160) = 0u;
*(_BYTE *)(v5 + 176) = 0;

The RSA check still happens on the odm key.

if ( !(unsigned int)DLMVerify::RsaVerify((DLMVerify *)v41, v42, s, v10) )

`v42` is a 16 char key. `s` is a 544 long char array. `v10` is... a pointer to a char array maybeeeeee... It's defined like this `char *v10; // x3`. (I have no idea how C works, sorry. Is it a static reference?)

Addresses 00485010 - 00485090 have some interesting stuff.

At 00485010 - 00 there's a simple 0 and noting else.

At 00485030 there's a weird code, `89***********045` (16 chars). It's not my IMEI btw.

And from 00485050 to 00485090 there's a JSON file. (I guess it's the one that readDownloadModeData is looking for)

{
"login_mode": "production",
"download_mode": "after-sales upgrade"
}

Those things are pretty useless, but 00485030 might be the key used by RSA verification.

The key sent by realme's server does fit the array, but it doesn't fill it entirely (mine is 528, array is 544)

I'm very confused.

PS: Looking at this pseudocode is painful, especially when you don't know C at all.
[General Topics] DRS_Frizzy:
It's nice to hear all this information but what gives us this key?

Can this key help us unlock Bootloader on Oppo?
[General Topics] melontini:
Well, maybe... The only reference I have is this half broken decompiled service code.

There's also the question of the magical fastbootUnlock transaction, where does it go? Where's the IOplusEngineerManager implementation? What happens to the server key? If one's bootloader is locked, does it make 00485010 - 00 equal to 1?

My knowledge on this topic is close to 0. And while I really hope this info is not 100% garbage, there's no way to know atm.
[General Topics] User154:
I have spent many hours looking for where the transaction goes. I mean theres all the crap with the key but ultimately that key is verified on device and then something happens which allows access to fastboot, or more to the point stops it from rebooting when we try to enter fastboot.

I was having a casual look over decompiled framework files I pulled from my device the other day and looking at its implementation in java I think the "vendor-oplus-hardware-engineer@1.0-service" file is a binderized hal. It seems to match up with the developer reference:

Binderizing passthrough HALs

You can binderize HAL implementations that support passthrough mode. Given a HAL interface a.b.c.d@M.N::IFoo, two packages are created:

a.b.c.d@M.N::IFoo-impl. Contains the implementation of the HAL and exposes function IFoo* HIDL_FETCH_IFoo(const char* name). On legacy devices, this package is dlopened and the implementation is instantiated using HIDL_FETCH_IFoo. You can generate the base code using hidl-gen and -Lc++-impl and -Landroidbp-impl.

a.b.c.d@M.N::IFoo-service. Opens the passthrough HAL and registers itself as a binderized service, enabling the same HAL implementation to be used as both passthrough and binderized.
[General Topics] melontini:
It 100% is a binderized hal, all methods from the engineering framework are implemented there.

But fastbootUnlock is not part of this framework. It's part of the engineering manager app. The method is called by the stub implementation of `android.engineering.IOplusEngineerManager`.

I guess something somewhere is calling the IOplusEngineerManager$Stub (I think it was stub, don't have a reference atm) onTransact() where it verifies the key with some fastbootUnlock implementation and if it passes, parcel2 returns either 1 or 0, where 1 unlocks and 0 locks fastboot. I've been looking, but I can't find this "something".

Although, 1/0 might be just verification that unlock was successful and the real unlock happens in this "something"
[General Topics] User154:
Its really great to have someone else looking at this, it makes me want to start looking into it all again 🙂

When I was on the developer reference last night to find that snippet about hidl I did see that it has been deprecated since android 10 and is migrating to use aidl everywhere. I had a quick look over aidl, I thought it looked similar to the implementation of IOplusEngineerManager in the engineer app.

I opened up my decompilation of the engineer app again this morning and it does seem thats what going on.

From the developer reference:

The Android SDK tools generate an interface in the Java programming language based on your .aidl file. This interface has an inner abstract class named Stub that extends Binder and implements methods from your AIDL interface. You must extend the Stub class and implement the methods.

In the engineer app the declaration of stub is:

public static abstract class Stub extends Binder implements IOplusEngineerManager

But I have no idea what service it communicates with because as you say fastbootUnlock is not implmented in vendor-oplus-hardware-engineer@1.0-service

Sorry if this does not make sense, I have not had much sleep lol
[General Topics] melontini:
I found OplusEngineerManager implementation. I hate this. It's oplus-framework.jar btw

private static final String ENGINEER_SERVICE_NAME = "engineer";

private OplusEngineerManager() {

}

private static IOplusEngineerManager init() {

return IOplusEngineerManager.Stub.asInterface(ServiceManager.getService(ENGINEER_SERVICE_NAME));

}

public static boolean fastbootUnlock(byte[] data, int length) {
IOplusEngineerManager manager = init();
if (manager != null) {
try {
return manager.fastbootUnlock(data, length);
} catch (RemoteException e) {
return false;
}
}
return false;
}
[General Topics] User154:
I have seen this but it still isn't the actual logic for the fastbootUnlock method it just calls the method from the engineer service