[General Topics] melontini:
So, I think I want to recap everything I know about fastboot verification based on Realme 8 pro:

The two structs:

The "old struct": If your key is 528 chars long, your phone will use the "old struct" which verifies the key using an RSA (I believe X.509) key and the serial key encoded at the end and.

The "new struct": Everything from the "old struct" still seems to apply, but now the key has your model name + RPMB key attached (I think). The model name from the Realme key is checked against the one stored in RPMB.

The fastboot order, but I made up all the method names:

Before loading the fastboot app `launchFastbootApp` calls `verifyFastbootAccess`, where if it fails, "fastboot_unlock_verify error and reboot." is logged and your phone reboots.

Inside `verifyFastbootAccess` your phone first checks if Secure Boot is enabled, if not, the fastboot check is skipped completely.

I'm not sure which Secure Boot the method is talking about, but I assume it's this https://www.qualcomm.com/content/da...ot-and-image-authentication-version_final.pdf

proof or smth:

uVar8 = checkSecurebootStatus(uVar7,uVar10,(int)uVar12);
uVar10 = (undefined)uVar12;
if (((uint)uVar8 & 0xff) != 1) {
cVar4 = shouldPringMsg();
if ((cVar4 != '\0') && (cVar4 = FUN_00035b70(-0x80000000), cVar4 != '\0')) {
log(0x80000000,(byte *)"secure boot is not enable \n",uVar10,in_w3,in_w4,in_w5,in_w6,
in_w7,unaff_x30);
}
if ((uVar8 & 0xff) == 0) {
cVar4 = shouldPringMsg();
if ((cVar4 != '\0') && (cVar4 = FUN_00035b70(-0x80000000), cVar4 != '\0')) {
log(0x80000000,(byte *)"skip fastboot verify when secureboot is off!\n",uVar10,
in_w3,in_w4,in_w5,in_w6,in_w7,unaff_x30);
}
uVar8 = 0;
DAT_00079da1 = 0x31;
goto LAB_000480f0;
}
}

If Secure Boot is enabled, the good old opporeserve1/oplusreserve1 is read.

First off, the serial in the key is checked against your real one.

Immediately after checking your serial, `verifyFastbootKey` is called, where this is used:

if ((*(char *)(param_2 + 0x21) == '0') && (*(char *)((longlong)param_2 + 0x109) == '0'))

to decide which struct to use, where if == true → new struct, if == false → old struct.

If new struct is on, your model name is checked first. (Also "permission", but I'm not sure what that means)

Now your key is verified with RSA.

Funnily enough, fastboot seems to keep track of the amount of times `verify` succeeded/failed

log(0x80000000,(byte *)"The %d time fastboot unlock rsa verify fail\n",1,in_w3,in_w4,in_w5,in_w6,in_w7,unaff_x30);

Anyway, inside` verifyFastbootUnlockRsa` `verifyRsa` is called, even twice.

This is where X.509 comes in:

if (DAT_00063378 == 0) {
in_w2 = 'x';
lVar8 = (**(code **)(DAT_00063310 + 0x140))(&DAT_0005de44,0);
if (lVar8 != 0) {
cVar2 = shouldPringMsg();
if ((cVar2 != '\0') && (cVar2 = FUN_00035b70(-0x80000000), cVar2 != '\0')) {
log(0x80000000,
(byte *)"RSA: Failed to LocateProtocol gEfiQcomASN1X509ProtocolGuid %r\n",
(char)lVar8,in_w3,in_w4,in_w5,in_w6,in_w7,
CONCAT44(in_stack_ffffffffffffff84,in_stack_ffffffffffffff80));
}
goto LAB_000107d4;
}
}

After getting the protocol, the check is performed. Here are the messages:

"GetDataHash: HashFinal unsuccessful! Status: %r\n"

"GetDataHash: HashUpdate unsuccessful!Status: %r\n"

"GetDataHash: HashInit unsuccessful! Status: %r\n"

"GetDataHash: Invalid size! HashSize: %d, DigestSize: %d\n"

"GetDataHash: GetHashSize unsuccessful! Status: %r\n"

"GetDataHash: LocateProtocol unsuccessful!Status: %r\n"

"VerifyHashWithRSASignature:Invalid pointer\n"

"VerifyHashWithRSASignature: mem allocation err for Key.N\n"

"VerifyHashWithRSASignature: mem allocation err for Key.e\n"

"VerifyHashWithRSASignature: SecRSAVerifySig success! Status: %r\n"

"VerifyHashWithRSASignature: SecRSAVerifySig failed! Status: %r\n"

"VerifyHashWithRSASignature: SecRSABigIntReadBin for Modulus failed! Status: %r\n"

"VerifyHashWithRSASignature: SecRSABigIntReadBin for Modulus failed!Status: %r\n"

"VerifyHashWithRSASignature: LocateProtocol failed, Status: %r\n"

"Failed to verify hash\n"

"Failed to get hash\n"

As you can tell by the messages, the method is pretty big.

Update:

I forgot that I shared the full method here: https://xdaforums.com/t/discussion-...astboot-on-oppo-devices.4490041/post-88602875