[OnePlus 10 Pro] evilhawk00:
I'm sorry for the late response. I was busy at work last week.

Yes, thanks to @hackslash, there's an example of the signature for ChipID: b73e685e(for the API authserver_domain/api/tools/sign)

{"Data":{"response":{"encrypt":"ct5/f+RsW/3p2vhIp2EduoMJ8kfKk2iNbF+eTExuGsOicfvILFTKY/+qF0WxSEcREt3m7YSABbEwCRU4aWaJqoppx2du60hW6OhTYbaL+51JXr5byRQjqqhtwJ1VfFZ66U3EuZXidJVW6TjV1u09fgt5MT11zSwZzbpkrBg1UQruJi8wGrjtMnq0mbgno1H01QRnMY+GKN9UqZVrXGAdCRJm8T8Ysn5P1mnIOVwhuJZSkq6z7WH9RhyM1oJuURquvZEt/TP9vQda1/fNn0txtzu+ZWkuuou23zYulXhkmtDTp5D4LtdZ8VlAkakq8UowHv3tlW7lZMb52fY8QjF/zw==","message":"0000","status":"0","unlock":"","isAllowDegraded":false}},"ErrorCode":0,"Message":null}

If you use Ghidra to do a static analysis with unpacked downloadtool.exe(first use a debugger to unpack vmprotect3.x),locate the defined string data "/api/tools/sign", you'll find a public key hardcoded in the tool to encrypt the HTTPS query to the server. All the transmissions are encrypted, but I don't even want to think about decrypting them because there's a ChipID problem.

The signature can be fed to the tool, but it doesn't work for other devices. For example, here's the download tool log for the device with the correct ChipID:

...
[COM51] Set Sahara file ok sahara file: prog_firehose_ddr.elf.
[COM51] Attempting to send a Sahara message for communication
[COM51] Downloading Firehose protocol file via Sahara protocol
[COM51] Sahara communication succeeded
[COM51] filename=ChainedTableOfDigests_20847_persist_no_userdata_yes
[COM51] Trying to handshake via Firehose communication
[COM51] Configure the settings of Firehose communication data transmission
[COM51] Get sign data
[COM51] ID:b73e685e, B:enable
[COM51] old_sw_name_sign:261fe06798cff432e5512eaa5339f797f2f213eaa739ddeea7f0985a048fe9e3, new_sw_name_sign:261fe06798cff432e5512eaa5339f797f2f213eaa739ddeea7f0985a048fe9e3
[COM51] Verify Data
[COM51] Verify pass
[COM51] Upload download result. chip id: b73e685e, result: -1, project: 20847
[COM51] Upload download result failed.
[COM51] Check the models and software
[COM51] Start erase
[COM51] Erasing the partition BackupGPT
[COM51] Erasing the partition PrimaryGPT/LUN1
[COM51] Erasing the partition BackupGPT
[COM51] Erasing the partition PrimaryGPT/LUN5
[COM51] Erasing the partition BackupGPT
[COM51] Erasing the partition PrimaryGPT/LUN4
[COM51] Erasing the partition BackupGPT
[COM51] Erasing the partition PrimaryGPT/LUN2
[COM51] Erasing the partition BackupGPT
[COM51] Erasing the partition PrimaryGPT/LUN0
[COM51] Erasing the partition userdata
[COM51] Download OCDT
[COM51] brand is oplus, cdtdownloadstatus is 0, ufs = 1
[COM51] Downloading ddr, zeros_5sectors.bin...
...

And here's the download tool log for the device with the mismatch ChipID(using the obtained signature to feed another device) :

...
[COM51] Set Sahara file ok sahara file: prog_firehose_ddr.elf.
[COM51] Attempting to send a Sahara message for communication
[COM51] Downloading Firehose protocol file via Sahara protocol
[COM51] Sahara communication succeeded
[COM51] filename=ChainedTableOfDigests_20846_persist_no_userdata_yes
[COM51] Trying to handshake via Firehose communication
[COM51] Configure the settings of Firehose communication data transmission
[COM51] Get sign data
[COM51] ID:b73e685e, B:enable
[COM51] old_sw_name_sign:261fe06798cff432e5512eaa5339f797f2f213eaa739ddeea7f0985a048fe9e3, new_sw_name_sign:9d975a304cf3d7d1f9f7ed402297996d7c457aea71fd0a5c2dc6278b68cde27c
[COM51] Verify Data
[COM51] FirehoseCheckRSP is ERROR, hr=1
[COM51] Rsp:
<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: verify failed." /></data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<response value="NAK" rawmode="false" /></data>
[COM51] Verify pass
[COM51] Current download task end,elapsed time:7s.
[COM51] Upload download result. chip id: b73e685e, result: 1, project: 20846
[COM51] Upload download result failed.
[COM51] Close the serial device
[COM51] Download failed
[COM51] Determine whether to upload the download info
[COM51] compress file, retry time is 4
[COM51] compress file success
[COM51] start to upload
[COM51] upload success
[COM51] Stop timer
End log...

As you can see, the device only accepts signed packets, and the signature is somehow related to ChipID. Anyone can simply use the hex-patched tool to try flashing your device, you'll see your ChipID in the log generated by the download tool.

At this point, I think the only solution is that the user has to at least pay to flash their device once to capture the signature for their device. And here's the hardest point, a lot of sellers check for packet capture software during the session. Yes, this can be bypassed via a rootkit(If you don't know how to program a simple hooking rootkit with Microsoft Detours, you can simply find some rootkit source code from hackforums or buy some rootkit source code from the dark web hacker sellers, then modify the code and compile it yourself) I believe that most users will fail to capture their device signature for EDL after being detected by the remote tech due to the lack for specific knowledge. By the way, can the captured signature with the same ChipId be reused on the same device? Please be aware, this is still unconfirmed! But I think it is highly possible that it can work for the same device every time.

But after seeing that @OppoTech123 is willing to help the community, I think maybe there's a chance that @OppoTech123 can help some developers to capture their device signature to boost the custom ROM development. But be aware that during the capture, the temporarily assigned token after logging in can also be captured, however, these tokens quickly expired in a short time. It doesn't expire for login but expires for querying signatures, not sure if it's related to OTP or if the account holder can log out from another place, be sure to protect your credits if querying a signature charge the tech some credits.

I don't think so. Maybe there's an internal Qualcomm development tool that can do that, but I definitely don't have it.