yashsingh1/xdaforums huggingface dataset:
[OnePlus 10 Pro] Canuck Knarf:
You can check this info.

Check unlock status #9434#

Entrance to the engineering menu *#36446337#
[OnePlus 10 Pro] S /\ E E D:
Is this permanent?

Or on device reboot we should unlock it again?
[OnePlus 10 Pro] belyj orel:
After the reboot, access will remain open.
[OnePlus 10 Pro] g96818:
It saves on the reboot, but i think it's only good for 24 hrs and then you need to run the unlock again.

Funny thing with after using this tool. My phone NE2215 says it's dual sim, but i can't figure out how to activate the second modem. So there might be hope for truly unlocking the second sim slot since it might just be device specific software locked.
[OnePlus 10 Pro] Canuck Knarf:
Dose your ne2215 come with two sim slots...? or one sim slot and add an e sim...?
[OnePlus 10 Pro] g96818:
ne2215 comes with contacts for dual sim, but no imei. There's also a couple other settings in engineering mode that shows sim2.
[OnePlus 10 Pro] Canuck Knarf:
Have you ever tried converting to NE2211 or NE2213 ...see if the second imei activates or shows up...I dont have a NE2215 to test that...But it also might boot loop the NE2215...I have the NE2210 (china) running NE2211 on one and NE2213 on the other
[OnePlus 10 Pro] g96818:
it won't work. it's likely a file that OPPO loads on the device, not something found in a MSM or ROM zip.
[OnePlus 10 Pro] DenisPDA:
Yes, it is spelled out by EFS

View attachment 5796897View attachment 5796903
[OnePlus 10 Pro] g96818:
It won't work on a real ne2215 model. IMEI is device specific, not something you can find on a rom. Your phone is bricked if you lose that partition. People have tried.
[OnePlus 10 Pro] Golv:
Very interesting file in the system - /system_ext/etc/engineermode/sys_secrecy_switch_list.xml

Spoiler content hidden.
[OnePlus 10 Pro] DenisPDA:
What's interesting?

In my opinion these codes have been published for a long time

Or did you see something ugly?
[OnePlus 10 Pro] Prant:
Some people claiming to have access even after the 24Hours. If so, anyone interested in further dev for this device should most likely do this as well before the 1st of January. Especially when the auth key generated is specific to decive and can be possibly used again using date shenanigans.

Just to get their phone into a state that is *more* properly tinkerable. As far as I can tell, this can unencrypt some (all?) of the partitions OPPO is hiding from us.
[OnePlus 10 Pro] Ph0nysk1nk:
Won't the token or whatever expire if the firmware is updated?
[OnePlus 10 Pro] g96818:
You are absolutely right. I just checked and i'm still unlocked at 27.5 hours.
[OnePlus 10 Pro] Prant:
Thanks for confirming. With that knowledge I tested it on VMWare, works fine in a Hardened VM. (Some small basic anti VM detections.) Unlocked my phone as well, here's hoping this token works perma.

Also confirmed that it uses a custom loaded driver that makes the "magic," hence why it will only work on Windows versions 1809 and older. Anything with the spectre / core isolastion patches will not work.

But it's working perfectly. Once the token is obtained and sent to device using whatever reversed OPPO function this guy is using... it basically unlocks the OPPO locked partitions with a full app to readout/test their dirty hiding. From what I've seen, you can see this with a typical root browser. There are so many more files, like a typical Android rooted device.

So this really makes me wonder, did OPPO engineer a way to lock the android system down on the SOFTWARE level, where it's basically fully functional but the juicy details are hidden without that server sided KEY. If this is true, I could see more and more modern devices moving towards this motto, leaving devices like Pixel and ROG alone for development.

Such a sad reality.
[OnePlus 10 Pro] belyj orel:
Unfortunately, access through the program remains open for ~ 36 hours. Then again you need to unlock through the program. To be able to unlock access to the engineering menu of your device on your own (without a program), but using the ADB command, you need to pull out the key (token).
[OnePlus 10 Pro] Prant:
Time-Gated server sided checks huh? That's pretty cool to be coded into such a low level, being completely honest. Very China like to keep control without too much interference with the lifestyle.

I suppose the question is now, will that key work again? I've seen on REALME forums using this app, that using date shenanigans makes the device open the menu like normal.
[OnePlus 10 Pro] belyj orel:
If you can pull out and save the key, then it will work through the ADB command, but for how long, the question is still open. I can check after a day (when the timing issued through the program ends).
[OnePlus 10 Pro] Golv:
Activation reset after approximately 48 hours. Reactivated with the adb command saved from the dump.
[OnePlus 10 Pro] belyj orel:
It remains to check whether the access will fail in 36-48 after activation by means of the key from the dump. It would be great if access remains constant.
[OnePlus 10 Pro] g96818:
how do you pull the token using adb?
[OnePlus 10 Pro] belyj orel:
The token cannot be pulled out using ADB. With the help of ADB, you can open access through the command with a ready token.
[OnePlus 10 Pro] g96818:
How do you save the token?
[OnePlus 10 Pro] belyj orel:
Download Wireshark https://www.wireshark.org/download.html. Install. Connect smart via adb. Run the GTool_Pro utility, select your smartphone, but don't start unlocking. Run USBPcap to dump usb ports (or you can do it directly in Wireshark). Start unlocking in GTool_Pro, wait until the end and write that everything is ok. Switch to USBPcap, stop the dump (or stop in Wireshark). Open the resulting dump in Wireshark, and there in the search find the command line by line, for example. landfills. Copy the command as text into Notepad and save it to a file.

The command for ADB will look like. like this:

adb shell dumpsys secrecy -config unlock_type=mac.imei=<imei>.encrypt_all=false <key>

Open command prompt (cmd) in c adb folder and paste this command. Naturally with your IMEI and key. Unlock engineer. the menu is thus possible at any time.

Information taken from the forum https://4pda.to/forum Provided by the participant https://4pda.to/forum/index.php?showuser=1584284
[OnePlus 10 Pro] g96818:
I couldn't find the usbpcap option, but the gtool stopped working already. I guess since it's 1/1/23 somewhere in the world.

Thanks anyways.
[OnePlus 10 Pro] Prant:
Damn. Yeah the tool stopped working, didn't get a chance to cache my key either. Wonder if you could pull it somehow from the device before the 48 hour window.
[OnePlus 10 Pro] S /\ E E D:
I think we can do whatever we want with root access

So fu*k the engineering menu! Lol 😂
[OnePlus 10 Pro] Prant:
I believe you will now be able to find the key stored in R00T:/mnt/oplus/op2/system/config/secrecy.cfg

I believe if we back this file up, we can use the RC4 key there to unlock (decrypt) our phones in the future.
[OnePlus 10 Pro] Canuck Knarf:
This is what i did...yesterday i was on NE2211 when I used this GA tool . I then was testing switching from NE211 to NE215 using oxygen updater and Android 13 APK . I left my phone on the NE2215 today when i woke up tried to get to engineer mode with *#36446337# . it would not open. I had a back up my NE2211 from Twrp folder . I went into recovery twrp with my phone on NE2215 . I restored my phone from twrp backup (which had the backup of NE211 and used GA tool ) . Rebooted my phone and it was now NE2211 and now i can get back into *#36446337#...weird
[OnePlus 10 Pro] Canuck Knarf:
How can i pull the keys from it...? It must be in my Twrp backup ...?
[OnePlus 10 Pro] Canuck Knarf:
Delete
[OnePlus 10 Pro] Canuck Knarf:
It has been Sun Dec 1 /23 when I did my twrp back up and now its Dec 6/ 23 and I still have Engineer Mode
[OnePlus 10 Pro] Prant:
Insanely smart to TWRP backup the whole phone while it was active. I'd be willing to bet that you will always have the secrecy unlock on that device, granted you continue to flash that backup. I'd probably have done the same if I was brave enough to flash that TWRP image.

Or do you actually mean, after you flashed the backup that one time you made, it has been +72 hours and the engineering mode still opens? If so... I wonder if the time stamp check is hard coded and you just successfully bypassed it by "reactivating" outside of the window.
[OnePlus 10 Pro] emabertax:
Hi, enable engineering mode can be used to enable volte/vowifi in settings ? If yes engineering mode stay open after 1-2 days ? Thank you
[OnePlus 10 Pro] Canuck Knarf:
Yeah that what i was thinking
[OnePlus 10 Pro] Canuck Knarf:
I opened program with Hex editor. Should be able to edit login info so we can run this program again...?... I dont know what line to edit..?
[OnePlus 10 Pro] Canuck Knarf:
If we can edit the login info would be the first start. I have been looking for it in hex editor . Cause i want to try it on my oppo find x5 pro...that oppo has locked the boot loader
[OnePlus 10 Pro] S /\ E E D:
No, not at all!

Root access is a MUST TO HAVE to enabling VoLTE since Logkit doesn't work anymore on OxygenOS 12+

Read my thread here:

[NE2213] How to enable VoLTE (OnePlus 10 Pro 5G)
[OnePlus 10 Pro] beatbreakee:
See my new post .. it's how Oppo has locked out bootloaders ... https://xdaforums.com/t/bootloader-deeper-functions-access.4538535/
[OnePlus 10 Pro] beatbreakee:
I wish I had knowledge on reverse engineering an exe file, bro and I would totally be of value... But this is one thing I must step back on.... I will run it thru some debuggers and see what I can find .. but we need an exe specialist here. Technically the same guy who found the offset in the Msm tool on our other thread, that allowed anything to be put in the username and password spots... That person would be my pick to solve this!
[OnePlus 10 Pro] beatbreakee:
what you are failing to pickup from the conversations is that I have 2 different phones... a Oneplus 10 Pro, and a Oneplus 10T ... both are from T-Mobile, and BOTH suffer the same problem with the MSM tool... BUT my 10T is from a recent batch of T-Mobile models that have OPPO's bootloader restriction in place, that disables FASTBOOT, and replaces it with FastbootD ONLY... In my other threads you will find the info regarding this, but let me fill you in quickly... as maybe you can help.

adb reboot bootloader , triggers a reboot that DOES make the phone try to enter fastboot mode, but it IMMEDIATELY reboots before the phone even has a chance to connect. like less than .5 seconds. I have traced the source of this and found a BUILD property that specifically amends the command BOOTLOADER and adds another REBOOT command to it as a default requirement... so basically the phone sees "adb reboot bootloader reboot" ..... Tricky huh?

There is no known way to BREAK this command from the kernel, nor delete the added command from the build.prop because that would require root. No root = No editing build.prop ... No build.prop edit = No way to remove the extra reboot. I have found that THIS is how OPPO has created their "Permanently locked bootloader" ... In fact the "In Depth Testing" apk for the Realme phones simply toggles this function from a "disable" bit to an "enable" bit with just a "1" or a "0" .... highly annoying

Now i need access for 2 reasons.... #1, is that i have a good idea of where in the EFS partition, the MSM tool is pulling that "auth signature" from... and because i have 2 different phones in the 10 series ON HAND, if i can get the 2nd phones bootloader unlocked, then i can pull the files , and work on spoofing/replacing them with a generic file to see if i can break the "auth" function of the MSM Tool.... If i can put just the right spoofed value into the file location, and get the flash tool to pass it, then i can write a script and add that generic signature DIRECTLY to the MSMTool so that the only thing a person would need is the tool with the bypassed login. (i have successfully flashed, flashed again, and reflashed, my 10 Pro about 50 times now testing my theory... but it only becomes viable, if i have a 2nd or 3rd device to test against.) #2. While i do know somewhat how to perform the flash, I dont know anyone personally with a 10T that i can test on, which is not a T-mobile. The problem lies directly in my inability to unlock my bootloader.

So what i really need is someone either with a solid knowledge of Qualcomm's tools, or a straight android hacker who can tell me a way to flash something with a modified build.prop that will overwrite the one currently in place... or some way to FORCE merge changes to the build.prop file... without root access.
[OnePlus 10 Pro] Renate:
I presume that somebody has already exhaustively searched for a UART?

If you interrupt the boot sequence with keys you can probably jump to fastboot.
[OnePlus 10 Pro] beatbreakee:
oh and i also confirmed that this function is indeed inside another menu in the engineering mode app... so thats just another issue... because according to the tech i chatted with about 4 days ago, "There are different levels of the engineering mode apk which are accessed by different ussd codes.... while some access functional menus that LOOK similar to another, each code grants different access to tabs which might be not accessible from another."

well i ran a few app inspectors, and app profilers at the engineering mode app on both the 10Pro, as well as the 10T ... then compared the 10T and the Realme to the 7T which had the "fastboot" option available in engineering mode. I found several similarities that were present ONLY in th the 10T, Realme, and 7t ... but no other phones that had fastboot already accessible, so to me that confirms that there is at least one , if not more dialer codes still out there...

I know alot of ppl dont know the code *#649010# which will give them the option to enable every usb protocol at once on the phone, opening up a slew of other Qcomm apps that can talk to the device. But thats just 1.... if you open *#899# vs *#3644337# and you select the Manual Testing tab on both menus, you will have some things you can change on one and not the other... So what i REALLY need is for someone to either tell me how i can take my phones Kernel, or whatever and pull ALL of the USSD codes that are prrogrammed into it! That would solve my problem almost guaranteed!
[OnePlus 10 Pro] beatbreakee:
??? lol my friend you just spoke greek to me... i understand what a UART is .... and i THINK i can access this mode.... if you are familiar with qualcomm let me tell you what protocols my USB enables currently....

ADB, DIAG, DIAG_MDM, QDSS, QDSS_MDM, RMNET, Serial, DBL , and QCOMM WAN

...

basically i get 7 total devices added to my windows device manager when i plug in.

3 under USB serial bus controllers (one of these is serial.. the other QDSS, and DBL)

1 under Ports (DIag)

1 modem (Diag_mdm and QDSS_mdm share it)

1 network adapter

and 1 Portable device

so does one of those have UART capabilities and also can you help with a command that would be used as well as name a program to send them with.

I honestly think i may be just mental here, but i could have sworn there was some old method of accessing system level device functions using AT commands... but i might be just remembering some crap from a movie.... but i am open to ALL suggestions now... cuz i am very close...
[OnePlus 10 Pro] Renate:
@beatbreakee

Those are all running off the USB which runs late.

Qcom ROM bootloader -> xbl -> abl (aboot)

Real fastboot is probably still in abl even if they tried to kneecap it.

There are usually "magic keys" to select different modes.

But it also has a command line interface, usually with diagnostics and stuff.

Excerpt out of an abl:

1cc8:	900001a1	adrp	x1, 0x35000 ; "BootIntoFastboot detected. [%u ms]\n"

1d30:	900001a1	adrp	x1, 0x35000 ; "BootIntoRecovery detected. [%u ms]\n"

1d6c:	900001a1	adrp	x1, 0x35000 ; "BootIntoDload detected. [%u ms]\n"

(The instructions are the same but there are addends not listed.)

Usually the "magic keys" are standard, VolUp/VolDn, but they don't have to be.

The UART is a direct serial port on the SoC, usually running at 1.8V logic levels (in these days).

It may be used during xbl, abl, early Android boot or even the console service.

It can tell you a lot. Which is why it's often well hidden or disabled.
[OnePlus 10 Pro] beatbreakee:
so does this have any connection?? because i had to use a special dialer code to turn it on...
[OnePlus 10 Pro] Renate:
@beatbreakee

That looks useful, but it's not clear whether they mean a USB serial or a hard serial and in which part of the boot phase. Presumably since they are talking about "performance" they mean while Android is running. Do you see a new USB interface appear?

Oh, and I just checked the UART on one device. It detects the four "arrow" keys and will even go to recovery with an up arrow. It doesn't look like there is any command line interface built in. Too bad. I've had earlier devices that I could use that mmc commands to read any block.
[OnePlus 10 Pro] Canuck Knarf:
I seen a new update for NE2211_11_C.25 ..I will install is and see if i keep Engineering mode.
[OnePlus 10 Pro] Canuck Knarf:
Ok i complete the update from NE2211_11_ C.22 (twrp backup ) installed update NE2211_11_C.25 through the phone . Bingo..still have Engineering mode...so i must of some how bypassed the Time stamp
[OnePlus 10 Pro] beatbreakee:
yeah it creates a usb connection on my computer that uses enables "Qualcomm HD Diagnostics usb serial" and a comm port...
[OnePlus 10 Pro] Renate:
Well, is it conversational?

I've never understood the penchant that Qualcomm has for creating a ton of 900x devices/interfaces.

It makes ADB seem brilliant with multiple shell, file transfer, JDWP, TCP forwarding on one interface.
[OnePlus 10 Pro] beatbreakee:
well i dont really know how to reply to that. I mean i literally have 23 Qualcomm apps and licenses for applications which i have NO EARTHLY IDEA how/what they are used for.... some seem useless... others seem like there should be a class taught by Stephen Hawking in order to use them... but those programs are what use all the other interfaces.... like i have no clue what QDSS or QDSS_MDM are used for, or DBL... Diag allows access to the EFS explorer which really is a dangerous place to be. You can literally deactivate, erase your imei, and delete the entire base programming for your phone, with no way to recover unless you have a backup. Its unrestricted access to the EFS partition which contains the Device_Config policy... the Carrier_Device policy, as well as the whitelist and blacklist for all packages on the phone.

i honestly figured that someone might know how i can edit my build.prop via the efs... since the EFS stays persistent even thru a full wipe in a custom recovery. And that deletes ALL of the OS files. If someone could tell me where to make my changes in there i guarantee it would succeed. The EFS is sort of GOD for the Android OS. It tells your phone What model, Imei,, SN, and the layout of the partitions ... without it you basically have a partially functional MP3 player... and i mean partially because on reboots, the phone would lose settings, as the persistent features would only stick in settings written outside of it.
[OnePlus 10 Pro] Renate:
I've never heard of efs (or seen it).

Here's a partition listing:

Spoiler content hidden.

So it's by no means a universal concept. Do you mean the GPT?
[OnePlus 10 Pro] mark332:
efs = modemst1, Modemst2, fsg(ab), fsc, located in lun 0 on emmc and lun 5 on ufs, these partition are responsible for network related operation, erasing these cause IMEI,WIFI Related issue
[OnePlus 10 Pro] Renate:
Oh, I'd never heard that term.

Of course if you trash the firmware or configuration partitions for the baseband processor it won't work.
[OnePlus 10 Pro] beatbreakee:
yes... the efs partition is what basically controls your devices ability to connect to cellular / wifi networks. If you screw anything up in there, you will have a perfectly functional MP3 player... and thats it! Your phone will lose its IMEI, ESN, IMSI, Baseband, and also in this partition is a directive that controls your phones power state. (learned this the hard way) When testing just how powerful accessing the EFS using QPST in Diag mode, i was able to literally disable ALL communication to a device! (luckily it was one of my throwaways, a oneplus 7T that had a bad screen) But removing several files by deleting them, eventually caused the QPST server to crash, then the phone showed some glitched text on the screen for a few min... after that it would vibrate like it was attempting to turn on... but would fail before the usb connection could connect. Test points had no effect then... but leaving it plugged into a power source would bring up the "powered off" charging indicator, which would reach 1% and reset on a loop, endlessly! Lol.... so like i said.. think of EFS as your phones personal god! Cuz without it, your phone becomes useless.... or with it crippled by altering the wrong files, you can turn your smart phone into a high dollar mp3 player!
[OnePlus 10 Pro] beatbreakee:
EFS refers to a partition on your device that contains radio/modem/nvdata/baseband/IMEI related software.

QCN is just the file extension that Qualcomm uses for specific EFS, IMEI, baseband related files. QCN file extension stands for "Qualcomm Calibration Network",

CERT refers to certificate files required by the EFS partition(signature for IMEI).

Everything that resides in the EFS partition is there to make your radio/modem work correctly.

Messing with this part of your software can brick the device if you aren't careful or if you don't use the right files.
[OnePlus 10 Pro] Renate:
Well, I stay away from all that stuff. On most of my devices I don't even use WiFi, let alone cellular.

And if I were to mess with that stuff, I'd make a full backup beforehand.

If you're rooted all you need to do is pull a full copy of your flash.
[OnePlus 10 Pro] longboot:
How did you get Twrp on ne2215. I didnt know it was possible
[OnePlus 10 Pro] longboot:
And what is GA tool
[OnePlus 10 Pro] Canuck Knarf:
Because my phone is actually....NE2210
[OnePlus 10 Pro] beatbreakee:
a quick look at an EFS for the Oneplus 10T
[OnePlus 10 Pro] longboot:
Thank you. Can you point me to where you got the Twrp for 2210
[OnePlus 10 Pro] Canuck Knarf:
https://xdaforums.com/t/guide-install-twrp-root-install-magisk-bypass-safetynet.4533511/
[OnePlus 10 Pro] beatbreakee:
Mine is a 2217 and i installed twrp. Look for the post in this Device forum that says TWRP in the title. Works perfectly, and i flashed it to both slots, so it is my phones only recovery now. Only function that doesnt work is Data decryption, but that is easily remedied by just disabling your screen lock passcode before entering recovery. Im able to flash magisk directly thru it and everything. (2215 and 2217 share exact same hw.. 2213, 2211, and 2210 share exact same hw... but there is only a minor difference and it doesnt affect the directory tree, which is all Twrp cares about, so any 10 Pro should be able to use it, provided that you have your bootloader unlocked!)
[OnePlus 10 Pro] Canuck Knarf:
Have you tried to use " x64dbg or x32dbg " to edit .... Unseen parts that Hex edit don't see...?
[OnePlus 10 Pro] longboot:
Thank you so much. I am on android 12 and want to stay on android 12. Well Twrp work on 12 or do i have to unroot go to 13 reroot to flash Twrp
[OnePlus 10 Pro] Canuck Knarf:
Buds I think its for Android 13 only...Im rooted on android 13 both phones NE2211 and NE2213 ...You should ask this questions in the twrp post you get much better help
[OnePlus 10 Pro] DenisPDA:
I still have this utility working

Perhaps there is a limit on N number of attempts in a certain period
[OnePlus 10 Pro] lmservas:
For anyone who still wants to access the Gtools program, you can use the following login credentials:

Username: gsmhamza@gmail.com

Password: gsmhamza
[OnePlus 10 Pro] abbbennett12353:
i honesty have no clue and im sure i am only making myself look stupid. is there already verstraight forward easy method to get into engineering mode? if so sweet, if not i found it and am also curious what is oifacing debuggable switch