yashsingh1/xdaforums huggingface dataset:
[General Topics] melontini:
Yeah, it's another proxy to the service.

In the meantime, this `com.android.server.engineer.OplusEngineerService` calls itself "engineer", but again, another proxy to a service which I can't find.

private static final String ENGINEER_SERVICE_NAME = "engineer";
private IOplusEngineerManager mOplusEngineerManager;
private IBinder.DeathRecipient mDeathRecipient = new IBinder.DeathRecipient() { // from class: com.android.server.engineer.OplusEngineerService.1
@Override // android.os.IBinder.DeathRecipient
public void binderDied() {
if (OplusEngineerService.this.mOplusEngineerManager != null) {
OplusEngineerService.this.mOplusEngineerManager.asBinder().unlinkToDeath(this, 0);
OplusEngineerService.this.mOplusEngineerManager = null;
}
OplusEngineerService oplusEngineerService = OplusEngineerService.this;
int i = oplusEngineerService.mRetryCount + 1;
oplusEngineerService.mRetryCount = i;
if (i < 5) {
OplusEngineerService.this.initService();
}
}
};

public void initService() {
IOplusEngineerManager asInterface = IOplusEngineerManager.Stub.asInterface(ServiceManager.getService(ENGINEER_SERVICE_NAME));
this.mOplusEngineerManager = asInterface;
if (asInterface != null) {
try {
asInterface.asBinder().linkToDeath(this.mDeathRecipient, 0);
} catch (RemoteException e) {
Slog.d(TAG, e.getMessage());
}
}
}

This class extends IOplusEngineerService (services.jar) which has a bunch of default methods, 0 from IOplusEngineerManager.
[General Topics] User154:
I think I've seen this but I can't be sure, I've looked at this from so many different angles.

I hate this too, I just want to see what fastbootUnlock actually does
[General Topics] melontini:
Something cool from OplusExSystemService

@Override // p000a.IOplusEngineerManager
/* renamed from: r */
public boolean mo3550r(byte[] bArr, int i) {
if (OplusEngineerService.m3580e(OplusEngineerService.this)) {
return EngineerHidlHelper.m3207k(1000055, bArr, i);
}
return false;
}

public static boolean m3207k(int i, byte[] bArr, int i2) {
m3212f();
try {
if (f8898a != null) {
Class<?> cls = Class.forName("vendor.oplus.hardware.engineer.V1_0.IEngineer");
Class<?> cls2 = Integer.TYPE;
return ((Boolean) cls.getMethod("saveEngineerData", cls2, ArrayList.class, cls2).invoke(f8898a, Integer.valueOf(i), m3204n(bArr), Integer.valueOf(i2))).booleanValue();
}
} catch (Exception e) {
e.printStackTrace();
}
return false;
}
[General Topics] melontini:
If anyone asks, OplusEngineerService.m3580e is a security check

static boolean m3580e(OplusEngineerService oplusEngineerService) {
Objects.requireNonNull(oplusEngineerService);
int callingUid = Binder.getCallingUid();
if (UserHandle.getAppId(callingUid) == 1000 || UserHandle.getAppId(callingUid) == 1001) {
return true;
}
StringBuilder m9732a = C0058f.m9732a("Permission Denial : can't access from pid=");
m9732a.append(Binder.getCallingPid());
m9732a.append(", uid=");
m9732a.append(Binder.getCallingUid());
Slog.d("OplusEngineerService", m9732a.toString());
return false;
}
[General Topics] melontini:
Good news! I think I have an idea of what oppo's unlock key might be!

Bad news! It's a bunch of garbage hex data (undecodable) which needs to be filled inside opporeserve1, ended by your serial number. The starting address is 0045A000 (if you have an emmc: 00440C00)

This data might not be random, but the last line (0045A100 address) is 100% my serial in hex.
[General Topics] User154:
So

This is great! I have some questions if you don't mind?

Have you been working off files dumped from your own device?

If so, did you get them via edl?

How did you find the key? Is it the key you obtained from realme? That was 16 characters short so appeneding the serial to the end would make it the right length?

Do you think it would be possible to write to opporeserve via edl? (using poke command)
[General Topics] melontini:
I've already unlocked my phone using turistu's rmx3474-rooting script. https://github.com/turistu/rmx3474-rooting

1. Yes and no, I just downloaded the full OTA package and unpacked system/ product/ system_ext/. vendor/ and odm/ are from device.

2. Just a rooted file manager. Although vendor and odm are shipped in the OTA.

3. As mentioned above. Both the application and the key itself were handled by the script (checkApproveResult returns the key). No, the key from realme already has the serial in hex appended.

I have a feeling that the first part is some sort of SHA hashed value. If you remove the serial at the end, the key becomes exactly 512 chars long.

The DownloadModeKey, get_key methods and readDownloadModeData don't seem to be related to fastbootUnlock.

4. I mean... maybe? But it might be possible to mod DeepTest to generate/consume a custom key.
[General Topics] User154:
I see, I am not rooted and have been working from a firmware dump that I found online.

I am able to pull the odm partition but nothing from vendor.

I have considered trying to modify the deeptest app but it will change the signature which will prevent it from even being installed. Any app with coloros in its package name must be signed with the oppo key.

Obviously directly writing data to a location on the flash using edl is fairly dangerous and would be a last resort.

Ps:

I think you may be right about the key being 512 in length. I have the key to unlock engineer mode for my device and coincidentally it is also 512 characters long.

I have viewed a secrecy.cfg file and it contains rc4 key also 512 characters long.

I don't know a huge amount about cryptography but looking up rc4 it seems it's common practice to discard the beggining of the keystream.

If you look at turistu's script it adds a random 8 character string to the begining of the key too.
[General Topics] melontini:
If the key is RC4, this means that fastboot can check its validity and it's not random. The key has to be generated from info extractable from the device.

I guess the key doesn't exist on oppo's servers before an application is approved and is generated from info sent by Deeptesting. Since IMEI and Serial are the only static values sent to oppo/realme. (the model is only used to check against a blacklist of model IDs) I believe those values are manipulated in some way to make an RC4 secret.

They have to be a secret because encoding IMEI, serial and that weird key from reserve only ends up with 78 chars. To make an encoded message 512 chars long, you need 256 chars in your original message. nah

One way to check what's going on is reversing fastboot, but that's kind of beyond me.
[General Topics] User154:
I would be shocked if it was rc4 after looking into it, its shockingly easy to crack. I didn't realise that's what WEP is based off, and we all know how easy that is to crack.

I'm not sure where the key comes from but I think if they did use rc4 they it would make sense for a secret to be generated on a per device basis.

I had a little look at abl the other day but it was very hard to read, It didn't look like it had disassembled correctly. I've been meaning to take another look

Edit:

Just checked out dogbolt and I see they have both ghidra and ida (hex-rays). Guess I won't bother with ghidra then lol

What sort of output did you get from using hex rays on dogbolt?
[General Topics] melontini:
Yeah. I tried using dogbolt.org, and only RetDec had something code-looking.
[General Topics] User154:
I used ida, I could see strings that were obviously related to fastboot but not much else, I was going to try with ghidra but also have another look with ida double checking the disassembly settings
[General Topics] User154:
Is that from abl.elf or the PE from within?
[General Topics] melontini:
I extracted it from dev/block without a file extension, ran a `file` command and since It said that abl is an ARM executable I tried decompiling it.
[General Topics] User154:
abl.elf is a uefi image, if you parse it as such you should be able to extract a pe
[General Topics] melontini:
v2 = (_QWORD *)sub_32F78(a1);
v3 = *v2;
v4 = v2;
v5 = *v2;
*v2 -= 96i64;
v6 = qword_5E528;
*(_QWORD *)(v5 - 8) = qword_5E528;
v7 = (_QWORD *)(v5 - 8);
v8 = ((__int64 (*)(void))loc_47F68)();
if ( v8 )
{
if ( (unsigned __int8)sub_35B48(v8) && (unsigned __int8)sub_11458() )
sub_356D4(0x80000000i64, "fastboot_unlock_verify error and reboot.");
v8 = ((__int64 (__fastcall *)(__int64))loc_183E8)(62i64);
}

I found this sus method (sub_10FBC), but it leads to a billion other smaller methods
[General Topics] User154:
I think definitley somewhere around here that the check is taking place. I was looking this morning and iirc its somewhere near here in a graph view where it can also split to the branch of a fasboot initialized message. I think it was sub1440 where it branched but I'm not too sure
[General Topics] melontini:
So, I found sub_479C0 (names might be different). Some interesting text from it and methods below it: "rsa verify fail, status is 0x%x", "the serial is not match\n". Bootloader also seems to compare model names if "rpmb" is enabled.

There's also sub_F018, which reads the opporeserve1, serial number, some sort of hash. There's also this message which can get logged "RSA: Failed to LocateProtocol gEfiQcomASN1X509ProtocolGuid", so it might be X.509 and not RC4.

Another interesting, unrelated thing is that "flashing avb_custom_key" in sub_14584 wasn't removed.
[General Topics] User154:
That's a nice a find, I really would expect they would use something other than rc4 given the ease at which it can be cracked.

Edit:

Remembered sering something about rpmb in the engineer app. I looked into it and its a secure storage section of the flash protected by a sha256 key

eMMC & UFS About eMMC (1)

Here is the document about eMMC ppt docMulti Partition eMMC 4.3  2 boot partitions and 1 user data partition eMMC 4.4  RPMB partition is added 4 general...

jaehyek.github.io
[General Topics] melontini:
Interesting method:

ulonglong FUN_00047d60(longlong param_1,undefined8 *param_2)

{
uint uVar1;
undefined8 *puVar2;
char cVar3;
ulonglong uVar4;
ulonglong uVar5;
char *pcVar6;
undefined in_w2;
undefined in_w3;
undefined in_w4;
undefined in_w5;
undefined in_w6;
undefined in_w7;
undefined8 unaff_x30;

if ((*(char *)(param_2 + 0x21) == '0') && (*(char *)((longlong)param_2 + 0x109) == '0')) {
cVar3 = FUN_00035b48();
if ((cVar3 != '\0') && (cVar3 = FUN_00035b70(-0x80000000), cVar3 != '\0')) {
log(0x80000000,(byte *)"use the new struct.\n",in_w2,in_w3,in_w4,in_w5,in_w6,in_w7,
unaff_x30);
}
if (*(char *)((longlong)param_2 + 0x10c) == '1') {
uVar4 = FUN_00047bd8((longlong)param_2);
if ((uVar4 & 0xff) != 0) {
puVar2 = (undefined8 *)(param_1 + 8);
thunk_FUN_0000cb98(puVar2,param_2 + 0x20,8);
*(undefined4 *)(param_1 + 4) = 8;
thunk_FUN_0000cb98((undefined8 *)(param_1 + 0x10),param_2 + 0x21,4);
uVar1 = *(int *)(param_1 + 4) + 4;
*(uint *)(param_1 + 4) = uVar1;
thunk_FUN_0000cb98((undefined8 *)((longlong)puVar2 + (ulonglong)uVar1),
(undefined8 *)((longlong)param_2 + 0x10c),0x20);
uVar1 = *(int *)(param_1 + 4) + 0x20;
*(uint *)(param_1 + 4) = uVar1;
thunk_FUN_0000cb98((undefined8 *)((longlong)puVar2 + (ulonglong)uVar1),
(undefined8 *)((longlong)param_2 + 300),0x10);
*(int *)(param_1 + 4) = *(int *)(param_1 + 4) + 0x10;
thunk_FUN_0000cb98((undefined8 *)(param_1 + 0x10c),param_2,0x100);
*(undefined4 *)(param_1 + 0x108) = 0x100;
thunk_FUN_0000cb98((undefined8 *)&DAT_00079da0,(undefined8 *)((longlong)param_2 + 0x10c),
0x20);
goto LAB_00047eb0;
}
cVar3 = FUN_00035b48();
if ((cVar3 != '\0') && (cVar3 = FUN_00035b70(-0x80000000), cVar3 != '\0')) {
pcVar6 = "the model name is not match\n";
goto LAB_00047f44;
}
}
else {
cVar3 = FUN_00035b48();
if ((cVar3 != '\0') && (cVar3 = FUN_00035b70(-0x80000000), cVar3 != '\0')) {
pcVar6 = "the permission is not match\n";
LAB_00047f44:
log(0x80000000,(byte *)pcVar6,in_w2,in_w3,in_w4,in_w5,in_w6,in_w7,unaff_x30);
}
}
uVar4 = 0xffffffff;
}
else {
thunk_FUN_0000cb98((undefined8 *)(param_1 + 8),param_2 + 0x20,8);
*(undefined4 *)(param_1 + 4) = 8;
thunk_FUN_0000cb98((undefined8 *)(param_1 + 0x10c),param_2,0x100);
*(undefined4 *)(param_1 + 0x108) = 0x100;
LAB_00047eb0:
uVar5 = FUN_00048538(param_1);
uVar4 = uVar5 & 0xffffffff;
if ((((int)uVar5 != 0) && (cVar3 = FUN_00035b48(), cVar3 != '\0')) &&
(cVar3 = FUN_00035b70(-0x80000000), cVar3 != '\0')) {
log(0x80000000,(byte *)"rsa verify fail, status is 0x%x \n",(char)uVar4,in_w3,in_w4,
in_w5,in_w6,in_w7,unaff_x30);
}
}
return uVar4;
}
[General Topics] DRS_Frizzy:
I thought this thread got dead but no.

It's nice to hear some news but sadly I can't help much, me and user154(of course you made the most hard work user154) worked hard but still didn't found anything so guys don't give up.

And about this codes sorry but I don't understand in coding too much it's very hard for me XD.
[General Topics] DRS_Frizzy:
So Oppo uses the same verification method like realme?

If yes as you said if secure boot is disabled it will skip fastboot verify,is there any way to disable this secure boot? And has anyone tried looking into enginner menu maybe there is a option to disable secure boot?
[General Topics] melontini:
I assume oppo uses the same process due to framework/partition names and an almost identical OS.

I don't think it's possible to disable secure boot. Maybe in a perfect world it would be possible to patch abl and push it through EDL, or in a super perfect world there might be a vulnerability similar to this https://www.pentestpartners.com/sec...id-bootloader-on-the-qualcomm-snapdragon-660/ (Although even this requires fastboot access)

For now, the only way to unlock an oppo/unsupported realme phone is to have a patchable non qualcomm SOC, or sell your phone and buy an unlockable one.

It's a real shame that oppo decided to lock fastboot in this way, but I just don't see a solution here.
[General Topics] melontini:
btw, after looking around GitHub, I found this very spooky tool https://github.com/H*/Qualcomm-*

I haven't tested it, but it does mention oppo/realme and "bootloader unlock".

If anyone wants to try it, go ahead, but I'm not responsible for anything going wrong. 😅

VirusTotal 8 detects:

VirusTotal

VirusTotal

www.virustotal.com
[General Topics] melontini:
After looking a bit further, the commands this tool executes seem legit,

It just wraps this tool https://github.com/nijel8/emmcdl

If you want to recreate what this tool does, here's it's GitHub, but keep in mind the VirusTotal score and my lack of responsibility. https://github.com/HadiKhoirudin/Qualcomm-Tool.

/application contains all the commands, /assets all the Loaders, drivers and pre-compiled executables.

Also, this https://manalyzer.org/report/58c5d5708130caec4a2e52586b9ea195 and this https://www.hybrid-analysis.com/sam...f802b9d084fe0be2003b2f17959d47aba787a14a41912

VirusTotal

VirusTotal

www.virustotal.com
[General Topics] melontini:
After a while of trying to figure out what this thing does, I think it does nothing. (or maybe I'm blind)

In source, it tries to write something to /devinfo.

Flipping the unlock bit in /devinfo works on old Xiaomi devices [1] [2] and this patch tries to write that bit. https://github.com/HadiKhoirudin/Qu.../resources/devinfo/XIAOMI-unlock-bl-patch.xml, but it doesn't work on modern devices because the bit is stored in the TEE instead [1].

But the realme/oppo/vivo patch tries to write `255`. Due to lack of documentation, it's not clear what this is supposed to do. https://github.com/HadiKhoirudin/Qu.../resources/devinfo/REALME-unlock-bl-patch.xml

Another tool wants you to patch /devinfo yourself: https://github.com/Naveen3Singh/BLUnlocker, but this tool is ~5 years old! And after looking at the issues, the success rate seems shaky... [3]

I bricked my phone while flashing a GSI, so I can't test this, and even if I could, I'm not looking for another brick.

And here's some more rambling:

Let's assume that this tool works, and that we actually live in a perfect world. You still won't be able to enter fastboot because OPPO protects FASTBOOT with a damn RSA KEY.

And even if you could enter fastboot, what are you going to flash? Thanks to OPPO's incredible work, you won't be able to find a proper fastboot ROM unless someone leaks it. Good luck rolling back to the stock/older ROM version!

There are no custom kernels as they often either do not release or release broken kernel sources (Realme 8 pro T kernel says hello! 2 years without source updates! [4]).

Their answer to ANY unlock question is, "Sorry, we care about your data, and we don't trust you with your own device!"

And all this is happening while Realme is going on about how "OSS friendly" they are on their Indian forum!

Sorry for this angry paragraph, but this entire debacle makes me mad.

[1] https://android.stackexchange.com/a/233302

[2] https://alephsecurity.com/2018/01/22/qualcomm-edl-2/

[3] https://github.com/Naveen3Singh/BLUnlocker/issues/1

[4] https://github.com/realme-kernel-opensource/realme_6pro_7pro_8pro_X2-AndroidR-kernel-source
[General Topics] User154:
Its looks slightly similar to the oem_unlock method here:

https://github.com/bkerler/edl/blob/master/edlclient/Library/Modules/generic.py

I am really sorry for mentioning abl, I didn't mean to send you down a rabbit hole.

I totally get your frustration. This is like the journey I went on with fasbootUnlock method. I found the method, then you needed the key. Then it didn't matter if you got the key because not just any app can reflect the class. It doesn't matter what you try to use the methods from that class, because only apps with oppo or coloros in there name or whatever can use those methods, oh and those apps must be signed with the oppo key to even install and run. If some developer were to coincedentally use one of those names in the package name for their app it wouldn't work on oppo devices. Even if it didn't try to access any of their hidden classes.

I really stupidly assumed oppo would be dev friendly like oneplus were. (Before my oppo I had a pixel 4, before that I had an OP3 + 5 and loved them). I didn't even look if you could unlock the bootloader before buying the phone, I just assumed it wouldn't be any hassle. My find x3 pro is starting to show its age and I will not be buying oppo again.
[General Topics] BotchedRPR:
On MediaTek devices that are exploitable with MtkClient you can unlock the bootloader via MtkClient, but then the recovery mode key combo changes to fastboot, BUT the fastboot boot mode still stays locked. This is presumably unlocked with the FastbootUnlock command, but can also be unlocked with a bootloader patch (look at my Reno Z thing)

Sadly none of this applies to Snapdragon devices ;( Could however be useful for MTK.
[General Topics] melontini:
The fastboot app is locked with an RSA key generated by OPPO. As per unlocking fastboot on mtk devices: https://github.com/R0rt1z2/oplus-unlock seems to do just that. (I should mention that I've never owned an MTK device before)

On snapdragon, it might be possible to do something similar with edl/emmcdl. Maybe...
[General Topics] BotchedRPR:
That, I know. Or another strategy from OPPO - not release any deeptest app at all (reno Z) :D

For my development I use mtkclient for unlocking the bootloader - after all thats required for flashing unsigned images.

Then comes a problem that even if the bootloader is unlocked, OPPO implemented checks in order to fully screw you up - if the fastboot mode isnt "unlocked" then the phone will just reboot.

I was so fed up that I started reverse engineering the bootloader, and because the bootloader was unlocked and that we have SP Flash bypass (sort of like EDL) I could flash the new bootloader and then have a fully unlocked MTK phone.

I don't have a Snapdragon phone. And even if I had one, step one fails. There'd be no exploit for unlocking the bootloader on snap devices.

Just saying the process to let you know that even if you manage to unlock the bootloader - therell still be a lot of challenges to unlocking fastboot

P.S: when you unlock the bootloader, OPPO removes recovery mode (at least on devices that were "forcefully" unlocked) I'm working on enabling that too, but it's proving to be temperamental. I might help with reverse engineering if you need me. Just tag me.
[General Topics] User154:
Total side note, do mtk devices have fastboot nowadays??

They never used to, I had an mtk as a f**k around phone a few years ago and there was no fastboot, only the mtk preloader which you accessed through sp tools
[General Topics] BotchedRPR:
MTKs have fastboot mode since a looong time. However it could be disabled per device or even removed. You probably had one of these.
[General Topics] StratOS_HTC:
EDL flash and firehose also use the oppo/realme signed keys.ON Realme Pro /Snapdragon it's hard to flash files if they are not signed and md checked :(
[General Topics] User154:
We are talking about an 8 year old phone here lol
[General Topics] BotchedRPR:
I had a device from 2013 with a MTK chip that had fastboot.
[General Topics] melontini:
I know that this is a fact, but I just wanted to give some more references:

Qualcomm's secure boot state is stored via QFUSE, which is a "Microscopic hardware fuse that is integrated into the SoC - Once physically blown, impossible to reset or replace"

"Qualcomm devices all use fuse based logic to dictate permanent feature configurations/cryptographic key sets. As stated above, the physical version of which is called a QFUSE, and is stored in a region on the SoC called QFPROM in rows.

If the QFUSE fuse row labeled Qualcomm Secure Boot is blown (which is such on non-Chinese/OnePlus deivces), PBL (Qualcomm’s Primary Bootloader) is verified and loaded into memory from BootROM, a non-writable storgage on the SoC. PBL is then executed and brings up a nominal amount of hardware, then verifies the signature of the next bootloader in the chain, loads it, then executes it."

Qualcomm’s Chain of Trust

Covering Qualcomm bootloader’s up to the point of Android being loaded

lineageos.org
[General Topics] BotchedRPR:
In theory, would a glitch attack work to break the CoT? It's out of reach obviously but just curious.
[General Topics] User154:
Wow you really are talking about a long time, glad I asked about it lol

In theory a glitch attack can break any security it's just a case of working out the glitch
[General Topics] BotchedRPR:
Not really, there are countermeasures against voltage glitching in todays day

I’m not into snapdragon. Don’t even own a working device with it. So I don’t know the SoC design well.
[General Topics] User154:
I think some of these have still been beaten though?

How come you're not into snapdragon, if you don't mind me asking? I've never been into mtk personally
[General Topics] BotchedRPR:
I just don’t have any devices with snapdragon chips. Developement that I am currently doing is on the galaxy note 20 and oppo reno z, and as my main phone I use an iPhone
[General Topics] melontini:
Yeah, buttons do get remapped for some reason. At least on the r8pro.

Locked: Vol up does nothing. Vol down goes to recovery.

Unlocked: Vol up goes to recovery. Vol down goes to bootloader.
[General Topics] BotchedRPR:
They made booting into recovery an oem command

fastboot oem reboot-recovery

should do it. At least on MTK. That's what I gathered from a ghidra stringdump of the lk on the reno

Edit: Oh ****. You guys get recovery access? On MTK after unlocking we can'tget into recovery AT ALL. Ignore the fastboot command then.
[General Topics] melontini:
BTW, the fastboot app is super locked, there are no easy bypasses. One option is to reverse the key algorithm, since it doesn't appear to be random (obv.), but good luck with that, lol. How can the key be written into (oppo/oplus)reserve without edl anyway? Faking the oppo/realme server responses?