yashsingh1/xdaforums huggingface dataset:
[General Topics] melontini:
Since there's nothing major to add, here's everything I know about the key

The key sent by realme/oppo is an ASN1 X.509 certificate signature (The first 512 chars). As per this https://www.qualcomm.com/content/da...secure-boot-image-authentication_11.30.16.pdf and as suggested by `VerifyHashWithRSASignature: SecRSAVerifySig success! Status:`

Messing around with the Chinese server (they killed the global server again 😡), the key changes based on IMEI, serial and model. The serial is added after the sig and with the `new struct` they started appending this after the serial `000210000000000000000000000000000000RMX2205#########` to every key. I have no clue what 21 is.

I would also love to find the cert itself, but I have no clue where it's at.
[General Topics] DRS_Frizzy:
Hi guysus here i found something idk if it's useful but it might help you with bootloader unlocking https://github.com/turistu/rmx3474-rooting I'm talking about oppo.pl,oppo-deeptesting... files
[General Topics] DRS_Frizzy:
But as he said without any privilege it wont do anything maybe there is a way to bypass key verification? Or somehow fake it? To be able to modify Deep Testing apk?
[General Topics] melontini:
This is great work by turistu, but it still requires a response from the oppo server, which it doesn't get, as far as I'm aware. You'll have to get a HeyTap account token from a valid 60+ day account, and maybe then it might be possible.

I consider the trail dead for now. Unless the X.509(!) certificate signature is reversable (unlikely) or there's some EDL trickery (maybe)
[General Topics] DRS_Frizzy:
Btw there is a tool (paid) to get token for engineer mode unlock can this token help us somehow with engineer unlocking?

Cellfix

cellfixpro.blogspot.com

Person said it cost 30 USD i could try to buy i have some on my balance but I'm saving for other thing just asking if enginner mode access help us with BL unlocking.
[General Topics] DRS_Frizzy:
There are many videos with this tools.
[General Topics] melontini:
No, it will not. Nowhere during the unlock is the engineering mode required. Don't waste your money.

You need an X.509 certificate signature for a proper unlock. Which, I think, is generated by OPPO's/Realme's server on the fly.
[General Topics] DRS_Frizzy:
Hi melontini I have a question did you tried extracting Oppo Firmware using edl? If no, then would it give us something useful, if we could extract it because it could be that Oppo just hided some files and maybe one of the hidden files could be the key that we are looking for or something useful?
[General Topics] melontini:
No, that not how this works.

OPPO's server sends you a signature which was generated using OPPO's private signing key. This key is secret and must be kept secret.

Your phone verifies the signature using server's public certificate. Which is stored on device.

It doesn't matter if you have the certificate, because you still need the signing key.

So, to get the private key you either need someone to leak it or spend 50 million years brute forcing it.

P.S If all you need is a valid signature, (+ a simple serial + model check) does it even matter what IMEI and serial you send to the server? Wouldn't the sig match anyway?
[General Topics] hex-16:
The best way to unlock the bootloader is to find a loophole to bypass the authentication, such as the bootrom vulnerability in the Silicon MediaTek chipset, and it will be difficult to patch it because it is at the hardware level, and there will always be solutions to reactivate the vulnerability
[General Topics] gargargar666:
I know I'm already late, you already found the problem in fastbootd and RSA signatures, but in Internet we have version of DeepTesting with debuggable:true, which means you can change/debug anything in this signed program.

Theoretically someone can call some other protected functions of Oppo/Realme without problem with selinux and have some desired side effects.
[General Topics] DRS_Frizzy:
I tried modifying it using MT Manager, it won't install maybe I have to do it from PC using android studios.
[General Topics] melontini:
The 'com.coloros.deeptesting.utils.Utils' class has the 'unlock(String str)' method which accepts the unlock key and reflectively calls 'android.engineer.OplusEngineerManager#fastbootUnlock'.

I have my old unlock key, so if it is possible to invoke this method, I'd appreciate some help.
[General Topics] gargargar666:
If you want just repeat ordinary procedure of processing answer in DeepTesting, you can try to set method breakpoint on processing okhttp3 response and change variables in Android Studio. I didn't test on response, but I changed request part (data before obfuscating with aes + sent headers) with 2 breakpoints. Just don't forget to do "Step Over" once, because you don't see any code and break on call itself.

Spoiler content hidden.

PS. I just noticed process working with android:sharedUserId="android.uid.system", that means we working on 1000 uid, it very high uid level, potentially one step closer to temporary root.
[General Topics] melontini:
Oh my ****ing god. Thank you so much!

I was able to inject a call to Utils.unlock (with my code obv.) before UserCenterHelper.isLogin and then the same thing for Utils.reboot and my phone successfully rebooted to bootloader.

If we can easily inject calls like this, we can call Runtime.getRuntime().exec() and do all sorts of fun stuff.
[General Topics] DRS_Frizzy:
I asked @melontini about unlock key and he said right now you can't get new key, is there any way to get this unlock key using this apk btw i use Oppo A74 not realme, but why do we need this key i mean let's image that Deep Testing actually works and when we tap start application we wait 30 days and then we can boot to Bootloader, can't we modify the APK so it skipped all this things and just reboot our device to bootloader, because @gargargar666 said that we can change(modify) apk. I swear if this apk won't help us then I hate this life. We are so close to break Berlin Wall.
[General Topics] DRS_Frizzy:
@User154 I think we need your help
[General Topics] melontini:
The key (signature) is required. The poopoo bootloader verifies it against a certificate stored on the device. To generate the signature, we not only need oppo's (realme's) private signing key, but we also have to know how they generate this signature. It seems that the left part of the key (signature itself) is a signed right part of the key (serial + model + seemingly, random data).

So, unless there's a bootloader exploit (kind of impossible) or someone kind, hot and handsome leaks their private key and key gen code, we have to cope, seethe and look for something else (like temp root).
[General Topics] User154:
I don't even have my Oppo anymore, it smashed last year and I went for a pixel instead. I haven't really got anything I can add sorry, I haven't looked at any of this in so long. Sorry I can't be of more help.

Hope you are all doing ok though.
[General Topics] DRS_Frizzy:
Okay if bootloader exploit is impossible, and I don't think that one Oppo dev will leak it I mean who would do that and lost his job, or go prison maybe it's a private thing and not allowed for them to leak it, left like you said temp root sad but at least something than nothing
[General Topics] gargargar666:
Yes, it can be easily done, just use Evaluate Expression (Alt-F8) after breakpoint, you can write any code with system permissions.

Spoiler content hidden.

code:

Process proc = Runtime.getRuntime().exec("whoami");

java.io.BufferedReader stdInput = new java.io.BufferedReader(new
java.io.InputStreamReader(proc.getInputStream()));

String s;
while ((s = stdInput.readLine()) != null) {
System.out.println(s);
}

output:
[General Topics] DRS_Frizzy:
Does it require unlock key too if not what can we do with this?
[General Topics] gargargar666:
No, it doesn't, I don't have unlock key myself. Potentially it can be used to get temporary root and do some nasty things (like deleting unnecessary soft, patching something, etc.) We still need find exploit to get root from system user and potentially in future to use some hardware bug/exploit to unlock device at all, but firstly we need root.

And it works on almost all Oppo/Realme devices.
[General Topics] DRS_Frizzy:
Hi guys, any news? I'm sorry if sometimes I ask dumb questions, but I don't exactly understand what you mean by exploit. Can we inject calls without a key and reboot to bootloader? From what I understood, when we send a request to a ColorOS URL, for example, 'apply-unlock,' we write IMEI, serial, etc., but we don't have a token/key. Can't we reboot to bootloader by injecting another call? I hate that I can't help because I don't know Java, I only started learning Python.

And about `Runtime.getRuntime().exec()`, you said we can call it. Can this [Runtime.getRuntime().exec()] somehow help us? We need to write everything we have on a document. By the way, what can we do without the key, and somehow figure out how to unlock the bootloader? If I'm correct, right now we're trying to use `Runtime.getRuntime().exec()` to get temporary root, but is it possible without bootloader unlock, or will it be more like a app that can perform root actions? Can we use it modify build.prop for example to set ro.boot.flash.locked to 0?
[General Topics] melontini:
Oh god, oh no. I just realized that realme now requires account login, just like oppo.

Well, anyway. We can't reboot to bootloader without the unlock key. The token sent to oppo's server is the oppo account token, you can only get it after logging in. It's different from the unlock key.

`Runtime.getRuntime().exec()` is a method which allows you to run shell commands through java code. Since we're executing this method through a signed system application, all the commands are run with the system uid (1000).

As per `ro.boot.flash.locked`, this is a prop set by the bootloader and basically does nothing, all the actual checks are done by the bootloader itself.
[General Topics] DRS_Frizzy:
reply:{`Runtime.getRuntime().exec()` is a method which allows you to run shell commands through java code. Since we're executing this method through a signed system application, all the commands are run with the system uid (1000).}

So what we are waiting for?

And is there something private in this app that should be chatted privately because I feel myself little unsafe when Oppo devs read all this. Can they do something to prevent us doing like you said root actions or patch something to prevent us doing calls to get root permission? And one more DONT UPDATE YOUR SYSTEM don't do it while we work with this!
[General Topics] melontini:
While yes, user 1000 is cool and all, but it's not 0. It can call some hidden methods/execute inaccessible commands, but it's still limited. For example, it can't access app data, user files, dev/block, etc. There has to be a privilege escalation exploit for it to be useful.
[General Topics] DRS_Frizzy:
From GPT:

As a user with UID 1000 (typically the first non-root user), you have limited permissions compared to the root user. You can run various commands on Android, such as basic system commands (ls, cd, mkdir, rm, etc.), package management commands (adb, pm, am, etc.), and more depending on your device's configuration and installed apps.

Regarding modifying files in read-only locations like the root folder (/), you typically need root access (UID 0) to make changes. Without root access, you won't be able to modify system files or directories that are read-only to non-root users. However, you can still modify files in directories where you have write permissions, such as your user-specific directories (/sdcard, /data/data/<your_package_name>, etc.) or external storage locations (if mounted with write permissions).

Is this the end of our uncompleted mission?
[General Topics] melontini:
Hmm, since we can basically write anything to oppo/oplusreserve1 now, I wonder if there's a way to trick the authless unlock server into generating valid codes.
[General Topics] melontini:
Btw, something of note (that I never noticed, for some reason). The verification function performs more transforms before sending the pointer to RSA verification when using new struct.

New Struct:

lVar2 = param_1 + 8;
avb_memcpy(lVar2,param_2 + 0x100,8);
*(undefined4 *)(param_1 + 4) = 8;
avb_memcpy(param_1 + 0x10,param_2 + 0x108,4);
uVar1 = *(int *)(param_1 + 4) + 4;
*(uint *)(param_1 + 4) = uVar1;
avb_memcpy(lVar2 + (ulonglong)uVar1,param_2 + 0x10c,0x20);
uVar1 = *(int *)(param_1 + 4) + 0x20;
*(uint *)(param_1 + 4) = uVar1;
avb_memcpy(lVar2 + (ulonglong)uVar1,param_2 + 300,0x10);
*(int *)(param_1 + 4) = *(int *)(param_1 + 4) + 0x10;
avb_memcpy(param_1 + 0x10c,param_2,0x100);
*(undefined4 *)(param_1 + 0x108) = 0x100;
avb_memcpy(&DAT_00079da0,param_2 + 0x10c,0x20);// Can't find any references to DAT_00079da0

Old Struct:

avb_memcpy(param_1 + 8,param_2 + 0x100,8);
*(undefined4 *)(param_1 + 4) = 8;
avb_memcpy(param_1 + 0x10c,param_2,0x100);
*(undefined4 *)(param_1 + 0x108) = 0x100;

So I don't think new struct keys will pass if you trick the bl into falling back to old struct.
[General Topics] DRS_Frizzy:
So you want bl to use old struct ( to accept old struct keys)? If yes of course new struct keys won't pass, but is it possible to force bl to use old struct?.

If I'm sure we need to change some value from 1 to 0 example: (text) = (1)for new struct and (0) for old, i hope it's not in build.prop. Again im not sure if its really true what I said, I'll take a look and reply later
[General Topics] melontini:
I meant using the key. The bl checks if 2, characters at a certain offset are equal to 0, so if you set those 2 zeros to something else, the bl will skip permission and model checks.
[General Topics] DRS_Frizzy:
And now we need to find this offsets?
[General Topics] melontini:
0x108 - first 0,

0x109 - second 0,

0x10c - permission, should be 1.

I can't match up those values with the non-hex version of the key because, In all cases, perm seems to be 0. Java just stabbed me in the back, lol. The first '0' comes immediately after the serial number and permission is actually '1', it comes after the '2' in the key. 😛
[General Topics] DRS_Frizzy:
So we need to change 0x108 and 0x109 to something else for example E or A 9/3... cant we change it one by one? 0/1/2/3/4/5/6/7/7/8/9/A..
[General Topics] melontini:
In theory, if the end of your key looks like this:

`deadbeef000210000000000000000000000000000000RMX1984#########`

Hex: `6465616462656566303030323130303030303030303030303030303030303030303030303030303030303030524d5831393834232323232323232323`

you could change it so:

`deadbeefTF0210000000000000000000000000000000RMX1984#########`

Hex: `6465616462656566544630323130303030303030303030303030303030303030303030303030303030303030524d5831393834232323232323232323`

This should skip model and perm check, but it will fail RSA verification (I think RSA, since my phone has no way to take bootloader dumps).
[General Topics] DRS_Frizzy:
How exactly can we write to oplusreserve1? By oplusre... you mean oplusreserve1.img?
[General Topics] melontini:
This was mentioned in the thread before.

Anyway, back to speculation. I think, the only real issue with the unlock verification is the model check. I wonder if it can be faked on-device somehow. The bl reads the device model from rpmb, but since this block changes, something must write it there. The engineering stuff had mentions of some rpmb key, but at this point I don't know.
[General Topics] DRS_Frizzy:
Me too btw have you ever wondered how some people on XDA could unlock Oppo Find X6 Qualcomm version:https://xdaforums.com/t/guide-unlock-bootloader-twrp-and-root-find-x6-pro.4648174/ I mean it's interesting how they did that.

Edit: I only see that they flash something on their phone. And the most interested is that it supports only Oppo Find X6 Pro why? Is there something special on this phone? Did Oppo allow to unlock bootloader on this phone?
[General Topics] melontini:
It seems that they have patched the abl.elf to disable fastboot verification, which possible and is very cool, but what's also interesting is that they were able to flash it using EDL. All firehose must be signed by Oppo to do basically anything, so someone must have leaked the signed firehose for that phone...?
[General Topics] DRS_Frizzy:
You mean that he edited the Firehose and then signed with Oppo signature?

Or do you mean that Firehose should be signed by Oppo?

And melontini let's be honest do you think that with this all all.. information we can unlock Oppo bootloader. Or it's just a waste of time because anything that we find requires key or root. A user found a deep testing where we can modify it how we want but still we need this F "KEY" 🫤 and the funny fact is that I can't help you I don't know a single programming language, i dont even know what opporeserve1, yes Sometimes i give some information like above about Finds X6 Pro. Why I'm saying all this is because we need help maybe some Chinese users can help us but we need to find them and ask them if they want to help us.
[General Topics] xuanhoang1811:
No, afaik they will replace the original ocdt partition with the OnePlus's ocdt one and after that bootloader can be access. The oplus sm8550 firehorse exploit is the key to do it.
[General Topics] xuanhoang1811:
can i use it for request an OPPO one?
[General Topics] melontini:
They have a different URL, but the API is the same. So, I'd assume - yes.

https://ilk.apps.coloros.com/api/v2/
[General Topics] melontini:
Yeah, this makes sense. I guess they're also using the abl from that phone too, since the thing I mentioned before is basically impossible to do without unlocking beforehand due to everything being signed top to bottom.

Anyway, is there any info on what purpose ocdt actually serves?
[General Topics] dick_vigarista:
this tread reminds me of this:

EDL Flash Tool Leak

Hello all, i am here to leak OPPO tech tool that allows one plus 10 pro to be flashed. Sadly i cannot share login but if you are able to bypass login screen the tool does not need to authenticate with server to flash device in EDL mode. Attached...

xdaforums.com

maybe there is any information there you guys could use idk
[General Topics] atooo7:
Is there any method or theory to either adapt the x6 pro tool for other Realme's, or patch in IMEI without unlocking? most Realme's can just sideload Chinese to unlock, or use other exploits like on MTK, but my global Realme GT2 RMX3311 neither works currently. turtius' tool technically "passes" but the app doesnt authorize me for bootloader, so goes back to system. Can go to fastbootd but everything is just "not implemented". Unlockable regions are RMX3312 with different modem firmware, meaning my imei is gone so i cannot apply for Deep Testing. Trying to run commands through Bkerler's EDL project, i get stuck due to VIP programming. If there was a way to use Engineering Mode for writing back my IMEI that could possibly work too.
[General Topics] DRS_Frizzy:
I don't understand what the problem is? What do you mean by: meaning my IMEI is gone. ? Btw about Flashing, I don't think that someone of us would risk to flash their phones, (especially me) I mean it should be 1000000% safe to flash it. And I still didn't understand what melontini mean by leak Firehose file, can't we extract it from our device or how it works? And one more thing, why there are multiple deep testing apks for specific models? Can't we extract the key using deep testing, doesn't the APK generate the key for fastboot unlock?
[General Topics] atooo7:
problem is there seems to be no way to unlock bootloader for now on an RMX3311.

imei is gone because indian/chinese GT2 has different firmware for the modem, it cant recognize ours, therefore imei is 000000000 unless you go back to global. (switching to india/china to unlock bootloader is a method on other phones like GT2 Pro). DeepTest does not work outside of india and china since last August. I don't know why there are lots of different DeepTest apk's, i tried a few and they all seem to be the same app.

Using edl to bypass authentication is another method on phones like Xiaomis but i couldnt get it to work due to "OPPO VIP Programming" blocking commands outside of a service center employee. The linked-above post for Find X6 Pro seems to overcome this with patched files.

Flashing is what you'll do after you unlock bootloader!:)
[General Topics] melontini:
There are only 3 deep testing versions: 1.0.0, 1.0.1 and 1.1.0

1.0.1 is basically the identical to 1.0.0, just with the oplus signing key. 1.1.0 starts using the v2 API.

When realme says "we've released deep testing for RMX1984" they mean "we've allowed RMX1984 to be unlocked server-side and just re-uploading the same APK."

And, again, the app is just a privileged proxy for interacting with system frameworks. The app decrypts/encrypts server responses, gathers application info and calls OplusExSystemService to write the unlock code. That's basically it.

There's no way to unlock without

- A: A valid key from Realme/OPPO servers.

- B: Having a signed ABL without verification.

A is possible if you can change your phone's region, B is possible if your phone is named OPPO Find X6.

What I don't understand is the RPMB stuff. How can reflashing your region change the model in RPMB? If the model name can be manipulated, then this is not so dead.

If someone feels like torturing themselves with Ghidra, parts of the qcom ABL are open source https://git.codelinaro.org/linaro/qcomlt/abl
[General Topics] DRS_Frizzy:
You mean for example change region OPPO A74 to Chinese or what? Will it work for OPPO A74
[General Topics] melontini:
I know that this works on realme phones, no idea about oppo, probably not.
[General Topics] DinoChien:
Hi,

My Oppo A74 (CPH2197) bootloader has been unlocked as shown in Picture 1, but I don't know how it was unlocked because this is an official refurbished phone (a welfare product).

I tried to flash Magisk, but as shown in Picture 2... Then I entered recovery mode to format the phone, but it seems to have entered safe mode as shown in Picture 3. Can anyone help me?

(I'm Taiwanese )
[General Topics] bunchkid:
Just wanted to know everyone's thoughts on this

Rooting an Oppo device

us.docs.wps.com
[General Topics] atooo7:
no support for 888? ant find an option for realme gt2
[Windows RT General] emmej88:
Hi, i wanted to play the games i can't buy anymore, like rayman fiesta run or assassin's creed pirates, so somebody can tell me what i have to do to download those games and install them on my windows rt 1 with win8.1?

Thanks
[Xiaomi Poco X3 Pro] Youmeko:
my original charger which came in the box has damaged. i have charged with another 33watt charger but charging animation doesnot show decimal and its shows the mi turbo charge but don't show decimal it is in miui global 13.0.3 stable version.

can anyone recommend which charger should i buy that shows decimal while charging and works like an original one?
[Xiaomi Poco X3 Pro] Tomo123:
Buy an original one from eBay or Amazon. I am not using mine, because I don't trust any fast charging meme, and would like my battery lasting more than a year ( and a half ), so I'm using a classic 10 W charger ( 5V 2A ).

My old Redmi Note 3 Pro still has a great battery capacity because of that. Ditched the original charger there, too.
[Xiaomi Poco X3 Pro] Youmeko:
what should i buy can you mention model of the charger??
[Xiaomi Poco X3 Pro] k3lcior:
In EU it's MDY-11-EZ.
[Xiaomi Poco X3 Pro] Youmeko:
check it is this charger good . look at the info in photo? i am using MDY-11-EX but it doesnot show the charging in decimal example 87.32%?