yashsingh1/xdaforums huggingface dataset:
[ASUS ZenFone 8] bnsmb:
Hi

Spoiler content hidden.

Spoiler content hidden.

I just learned from Renate that fastboot can only write some of the partitions -- not all. To write to all partitions and/or change the partitions a Firehose (EDL) loader is necessary.

If we get that working for the ASUS Zenfone 9 or 10 I could buy one of them

regards

Bernd
[ASUS ZenFone 8] Robin94:
That exception is interesting. I think you just found out there are 14945 registered phones with the same model (and possibly the same SN).
[ASUS ZenFone 8] Esja:
This is probably what the server does with a key. Either the Taiwanese guys have that key (old employees?) or they are using some other method.

Don't know if it helps you whatsoever but I have an old ROG Phone which is unlocked/rooted using the original tool. Not sure if I could copy some file or extract something useful for your research.
[ASUS ZenFone 8] nasch007:
I know it's for an older model, but we have a somewhat analogous situation. Has anyone tried following the steps here: https://zentalk.asus.com/t5/zenfone...oader-failed/m-p/354750/highlight/true#M10898 but instead using the RAW Android 13 beta? I had that image at one point and a few of the posters here may still have it. I just got my ZF8 back from Asus after a 2 month RMA process. I'm willing to give it a shot provided I can get some support from the forums here.
[ASUS ZenFone 8] nasch007:
Spoiler content hidden.

Spoiler content hidden.

Those were from my ZF8 pre-RMA. I flashed individual partitions using firehose and in EDL mode. Note I had the most success with the full QPST tools. I can attach the firehose I used here (if that's not ok, just message me and I'll remove). I am not 100 they'd work for ZF10 but it's worth a shot.

The output of the commands are exactly the same on my returned device post-RMA, with the exception of the IMEI/SSN changing.

The raw dump of all partitions and their data was done before shipping it off for RMA. There are some interesting partitions like storsec, keystore, kymaster, qeslicstore, etc. I don't know enough about their composition to be of much value, but here's a full listing of all partitions that were readable using edl/firehouse.

Spoiler content hidden.

I doubt any of this is useful to peeps like me but maybe helpful to those who know what they're looking for...?

Looking through some of these bin files in a hex editor, I also saw this:

ASUS-MAGIC-NUM!!lahaina
8GB
2.8GHz
ASUS_I006D
WW_ZS590KS_33.0210.0210.296
M8AIB760P5***** (<-my serial #) HB18ABBF0733X3R00A2A (unknown what this number is or what it means??
US
ASUS
false
true
[ASUS ZenFone 8] bnsmb:
Looks like the value returned by

fastboot oem isn-info

e.g. on my phone

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $ sudo fastboot oem isn-info

(bootloader) ISN_NUM = HB15HABF0700JTT00IRA

OKAY [ 0.001s]

Finished. Total time: 0.001s

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/scripts_on_linux ] $

regards

Bernd
[ASUS ZenFone 8] MDV106:
I have not a clue about Android development but i'm willing to help out where I can so we can finally get a working bootloader unlock method for this.
[ASUS ZenFone 8] nasch007:
You and I are in the same boat hahaha. A place to start, I did have the full Android 13 update, and would assume that includes some sort of cryptography or unlock to the bootloader. I started browsing the files in HxD (because I had no idea what else to do with them) and saw various interesting things. Because like you, I have not a clue, this probably means nothing. But interesting nonetheless!

I saw a few guids that were reused among files. I saw references to hardcoded IP address belonging to AT&T in like Seattle WA. I saw some references to Qualcomm San Diego and x509 certs, as well as strings that look suspiciously like the auth strings I used to unlock pixel or my old motorola. You know those huge strings you enter your key in to unlock the bootloader?

I saved a few. Then I searched online "arm decompiler" and came across this little site: https://dogbolt.org/?id=4ea5a895-d2c0-4526-a341-f56a74b028ae#RetDec=9482. It takes some of the files and makes them sort of readable by someone who knows what the heck they're doing. I looked at the files from the firmware portion of the Android 13 update and some are interesting.. uefi_sec (assuming secure bios)? and km41 (assuming keymaster? partition that's referenced several places). In any case, I'm kind of just tossing pebbles in a pond at this point, as I have no idea if any of this means anything. But it's interesting nonetheless.

"global variables" in the km41.mbn I thought looked suspicious:

char * g116[6] = {
"ffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
"ffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
"5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
"4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
"ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"
}; // 0x3c2a8

as well as

char * g117[7] = {
"ffffffffffffffffffffffffffffffff000000000000000000000001",
"fffffffffffffffffffffffffffffffefffffffffffffffffffffffe",
"b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4",
"b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
"bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
"ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d",
(char *)&g240
}; // 0x3c320

char * g240 = "\xf0\x01"; // 0xe0

I'm sure out of context this all a bunch of nothing. But maybe somebody knows how to find out more. I have the files if anyone has the time and know how.
[ASUS ZenFone 8] Ponso00:
Thank you. I'm glad this is solved but I already returned my zenphone 8. Now that I know this I might buy a zenphone 9 in the future
[ASUS ZenFone 8] nasch007:
I don't know, this all looks pretty sus.

The site is insecure (http://), everything is in Chinese, it looks to me to be a paid service/membership deal (https://www-romjd-com.translate.goo...uto&_x_tr_tl=en&_x_tr_hl=en-US&_x_tr_pto=wapp), the information seems to contradict itself regarding being eligible for updates: "After ROOT, the mobile phone does not support the WeChat fingerprint payment function and does not support updating the system. The ROOT is lost due to forced updates.", it specifically lists Android 11, and there've only been 24 downloads (if that's legitimate).

I'd take this August 14th, 2023 release with a heavy dose of salt. I'm not super keen on installing what very well may be Chinese spyware onto my phone. If someone else wants to dive right in and report back, that'd be swell.
[ASUS ZenFone 8] jstys92:
Probably a good call, this guy has been blasting this across multiple asus device forums.
[ASUS ZenFone 8] oscarjh:
What happened? It seems that we can't get in touch now. I successfully sought help there to unlock three phones
[ASUS ZenFone 8] oscarjh:
Don't PM me, I won't participate in sharing these, I need to figure it out on my own
[ASUS ZenFone 8] NANDO1413:
zen 3 have unoficial unlock BL https://zentalk.asus.com/t5/fan-chat/unlock-relock-bootloader-unofficially-for-zenfone-3/td-p/66968
[ASUS ZenFone 8] blackbile:
It is a 3 year old post...
[ASUS ZenFone 8] nasch007:
True, and for ZenFone 3? But perhaps the method still works, just not using those specific files.

I do believe there was an Android 13 Beta and a downgrade firmware back to Android 12 that may be this RAW type of data. I've used the flash_all.cmd and edited it and I'm just not skilled enough to really pick apart what it's doing. But *perhaps* if one of these RAW firmwares does leave you in a position where you can fastboot oem unlock (fastboot and fastboot oem are two different environments, afterall) then this has a shot.

Of course, it is unlikely that Asus would let an oversight like this remain after so many years. I don't have my ZF8 at the moment to test, though I would be willing.

If anyone wants to play test dummy, it could be helpful to post what yall find out.
[ASUS ZenFone 8] nasch007:
Wanna see a funny coincidence?

Just for fun I decided that looking at these they feel like encoded strings and I wonder what they say. Could be just hex, could be memory addresses, could be string literals (" asdasd" ). They sort of resemble base-64 encoded strings so I thought why not head there? So I did, and decoding them to UTF-16 produces output that looks sort of like an Asian language... like webdings characters.

So again, just for fun I cleaned it up and ran it through Google translate. In Chinese, they don't seem to mean anything. But if you select Thai, you get the following output:

What the actual hell?

I'm sure this is just a set of random errors and circumstances but I thought the output was so funny I would shared. "The most important thing in the world is that you will not be able to do this" -- that's them talking about this thread!!!
[ASUS ZenFone 8] nasch007:
Interesting... plugging these in at hashes.com identified the second string as hash for Full disk encryption.

ffffffffffffffffffffffffffffffff000000000000000000000001fffffffffffffffffffffffffffffffefffffffffffffffffffffffeb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34ffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d - Possible algorithms: Android FDE (Samsung DEK)

What if that's all it took... fastboot oem unlock and pass this key? Wouldn't that be nice.......... C'mon ASUS where's our tool already?
[ASUS ZenFone 8] barretoperez:
ASUS has never been able to keep their promises. Last time they said they would release a new unlocking tool at the end of Q3, but we didn't wait for it; then someone asked when it would be released, and they changed their mind and said it would be released by the end of October. October will be over in two days, but I haven't seen anything from ASUS, so I guess this time it's a bust. Obviously it's their excuse to keep blinking.
[ASUS ZenFone 8] Blumi511:
Where did you get the info that something would be released by the end of October?

I mean, not that I care. I actually bought this device to use it with lineage os after the 2 years of updates were over - then they f*cked up and I am here stuck.

Well, I mean, I've just transitioned to a s23 because I was not ready for their bs once more
[ASUS ZenFone 8] barretoperez:
This one: https://community.e.foundation/t/ze...cks-come-back-till-the-end-of-october/51943/5

The last message says: "I have mailed Asus on this matter. I received information that Asus is planning to give back option to unblock bootloader on Asus Zenfone 8 till the end of October this year "

And yeah, I changed my phone as well. ZF8 has become my backup phone, and it's just sitting in a drawer gathering dust now. Oneplus or Samsung should be much better.
[ASUS ZenFone 8] nasch007:
I've also gotten numerous emails from support during my RMA and prior that said Q3, Sept. or Oct. Mid October I emailed again and they said the same exact thing again.
[ASUS ZenFone 8] badaas:
Sigh 😔
[ASUS ZenFone 8] barretoperez:
I did another grab today of the HTTP request between the Asus unlock app and the server. This is the JSON result returned:

{
"data": {
"project_status": "active",
"project": "ZS590KS"
},
"retCode": 401,
"message": "UNAUTHORIZE"
}

I can clearly see that it recognized the model number correctly, but told me that the request was unauthorized (HTTP 401). I don't remember if this was the return value when the unlock tool first became unavailable. So if it's different, does it imply that ASUS has made some moves?
[ASUS ZenFone 8] nasch007:
Late and possibly stupid question, but noticing the comment about it saying partitions don't exist... have you tried the commands in both fastboot and fastbootd? I seem to only get fastboot oem commands to work in one but not the other. I wonder if partitions are hidden in one but not the other. Sorry for injecting a pleb response I've just been re-reading this thread now that I've seen some of the files.

I've also been curious about the x509 certs included in OTA updates and raw firmwares. And I've seen plenty of 0x100s but don't really understand the significance... also haven't gone as deep decompiling the code as you folks have here. Commendable efforts even if nothing fruitful comes still appreciate the investigation.
[ASUS ZenFone 8] nasch007:
Forgot to say, I did get my ZF8 back from the service center and it's locked from the factory. I have a complete dump of all partitions using the firehose and QFIL/QPST or whatever from before the RMA. I can dump and re flash partitions in EDL mode, but I'll say I didn't have much success before sending it in to RMA. The only thing that really worked in getting my phone at least bootable prior to RMA process was using the RAW firmware downloads and flashall_aft.cmd. But I'm willing to try writing dumping and writing partitions using EDL and firehose if you think it's safe/will help.

EDIT: Now that I think about it, they're saying the issue was hardware (they replaced the motherboard). How much of a risk of bricking it 100% do I have if I were to simply reflash all of the partitions... I dumped in EDL mode? Is that possible it would recover my user data (I would think not as probably RSA keys have changed with new motherboard/SoC), but wouldn't that be cool hahaha
[ASUS ZenFone 8] nasch007:
super.img\system_a.img\system\etc\init\ contains init.asus.unlock.rc, whose contents is:

# +++ ASUS BSP : User unlock tool +++
service writekey /vendor/bin/writekey
class core
oneshot
disabled

on property:sys.debug.write.asuskey=1
chmod 0644 /ADF/asuskey.bin
start writekey
# --- ASUS BSP : User unlock tool ---

So... asuskey.bin in that location??
[ASUS ZenFone 8] nasch007:
I wonder if this method is still viable? https://xdaforums.com/t/unlock-bootloader-zenfone-5z-apk-from-asus-website.3838109/ yes an old thread but people were reporting success this year. The gist of it is, grab a raw firmware and flash it, then go back and flash ONLY the android boot loader "factory", and pull the plug after it's been flashed in time to keep it unlocked... seems reasonable. They include abl.elf and xbl seems to be asus's boot loader. I don't know enough about it but what do you all think?
[ASUS ZenFone 8] nasch007:
I was re-reading this. Running getprop in a non-root shell returns an interesting ro (read-only?) value:

[ro.boot.cpuid.hash]: [ac0057418b9293fcb646e2fecc54d43c]

Could that be a secret cpu id??

Also, some of the other fastboot oem commands show similar:

>fastboot oem cpuid

(bootloader) CpuID = A93E516D

>fastboot oem get-cpuidhash

(bootloader) CPUID = 5BABC568

(bootloader) CPUID HASH = ac0057418b9293fcb646e2fecc54d43c

I can send you my ISN or iemi if you wanna continue down that path. Seems like you were on to something... also, the fact that you send your imei in plaintext, this seems like interesting output returned from yet a different fastboot command:

>fastboot oem get-imeiauth

(bootloader) ==================================

(bootloader) IMEI Auth = 35212046134026735212046134027500

(bootloader) ==================================

Also saw this that looks interesting:

[ro.vendor.udid]: [45e5a241ba83d9ee15f0e1e030e85c0d733ec96f197f01cc8c233abc22fd3d2e]

I tried to look up Android udid but everyone says that's an iPhone thing not Android. But obviously it's there, so what is it? A SHA2-256 256 bit long hash for... something.

This could all add up to exactly nothing, but seems worth investigating as ASUS has given us ZERO clue as to when to expect to be able to unlock legitimately again...
[ASUS ZenFone 8] nasch007:
Saw the note about fastboot only being able to write some partitions. When you get a raw firmware, you get an update_image.bat and a flashall_AFT.cmd. Editing those in notepad or (nano if you prefer) shows this line:

"set FASTBOOT=fastboot"

And there's a fastboot file with no extension (that isn't fastboot.exe) in the same folder.... it's certainly a binary so maybe it is somehow running as root or has some permissions to write all partitions (as the name implies)... Any clue if that helps? Also these raw firmwares do come with firehose loaders... in the /firmware subfolder there's prog_firehose_ddr.elf and prog_firehose_lite.elf

I can attach all these files if it helps.
[ASUS ZenFone 8] nasch007:
Adding to the weirdness... this is spitting into the wind at this point, but I did manage to flash a raw firmware I think of the Android 12 downgrade. Oddly enough, in the developer settings, the OEM unlock toggle is present, and you can even turn it on. It prompted me to reboot, however, I still could not oem asus-unlock (invalid token), nor could I fastboot flashing unlock. So. Interesting bit of trivia there. Don't know what it means but there must be code somewhere that's either in the build or something that disables that toggle and the underlying ability.

Anyway, seems like they posted another firmware update (waiting to install now)... having some display artifacts so trying to diagnose that... hopefully this makes things better and not worse.
[ASUS ZenFone 8] nasch007:
Just an FYI, the .296 firmware seems ok in regard to the flickering and black squares.

The issues I'm having in Brave and other Chromium browsers seems to be related to the apps themselves as far as I can tell not the underlying OS. For anyone else having issues in chromium based browsers like I was, try enabling chrome://flags "VULKAN". Mine was set to default (enabled) but forcing enabled seems to have remedied the issue. At least for now......
[ASUS ZenFone 8] Yoniyangtw:
https://twitter.com/i/web/status/1718591319575269624

I think people here might need this.

A tweet about this.
[ASUS ZenFone 8] nasch007:
What is [Note 1]?
[ASUS ZenFone 8] Yoniyangtw:
TLDR(maybe I read it wrong because because I am not native English)

ASUS server have bugs and some party is abusing it
[ASUS ZenFone 8] nasch007:
Oh ok. It seems to me in the context of his tweet that "Note 1" would be referring to a different tweet or article he's linking to. I don't have Twitter/X so I'm not sure how to find it.

So, if he does document the exploit of server bugs, is there any way for one of us to exploit it (without charging a fee, of course)?

I brought up the severe flaws recently brought to light in Google code and the Bluetooth exploits, along with again asking about the bootloader unlock and this was the response I received from support:

FWIW. That's from Angel P. I may post this on the Zentalk forums and just say what the heck gives -- are we, or are we not ever going to get a bootloader unlock app. But at this point I feel like I'm wasting my breath.
[ASUS ZenFone 8] nasch007:
Hey just to beat a dead horse here, it looks like they not only don't want to let you unlock your bootloader, but also refuse to patch known security issues. So you can neither have your cake nor eat it, apparently. I've got a response that I sent, one last time, but here's what I got back most recently:
[ASUS ZenFone 8] D-IMAN:
I found two people who unlocked bootloaders on ROG 3 and ROG 7 unofficially.

I'll try to write to them to find out more details.

Perhaps those who unlocked the bootloaders on ROG can also unlock them on Zenfone 8

It seems there is no point in expecting a “miracle” from ASUS...
[ASUS ZenFone 8] nasch007:
I don't speak Russian and translations seem buggy. Any native Russian speakers could translate? I saw posts that said something along the lines of:

That sounds extremely sketchy to me.

This post: https://4pda.to/forum/index.php?showtopic=1057120&view=findpost&p=111763373 is basically a walkthrough of how to flash raw firmware, which I've already done and probably many others. But it's hard to understand what it means out of context. For now I think we're just hopeless...

Edit: People much much smarter than me seem to have a lot of insight into firehose programmer and boot chain loading. These links were also buried in that same Russian forum: https://alephsecurity.com/2018/01/22/qualcomm-edl-1/ and https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html. I can't make heads or tails of it, but there's a poster on here that has a pretty detailed analysis of the bootloader maybe it's useful info to them...
[ASUS ZenFone 8] D-IMAN:
In short:

The Chinese installed software for remote access on his PC.

The zip archives that were used in the process (if I understood correctly) had a password set.

So all the apks were untitled.

The whole procedure took 2 hours.

During the procedure, asking what the Chinese does and what he uses is useless - he does not answer.

At the end, I did a factory reset, and Android 10 was installed.

I was answered by a person who unlocked the ROG 3 bootloader for a fee from a Chinese.

He gave 40 euros.

And he gave me a link to contacts.

(The same contacts of the Chinese were dropped earlier in this thread)

According to him, after unlocking, everything works well, no problems!

(If I'm sorry, I tried to write more clearly. Google Translate is not very smart...).

Another person who unlocked the bootloader for ROG 7 for a fee has not yet responded.

This instruction is not related to unlocking the bootloader.

This is just an instruction about RAW firmware.
[ASUS ZenFone 8] diroots:
https://xdaforums.com/t/unofficial-...thout-asus-server-q3-2023-muhahahaha.4649465/ 🎉
[ASUS ZenFone 8] zpunout:
Thanks for updating this thread with the news of an unofficial locking method. My next phone will now be an Asus
[ASUS ZenFone 8] wike.aj:
it better be old asus phone. the new ones still can't be unlocked using the unofficial method as far as I know
[ASUS ZenFone 8] zpunout:
I'm looking to get an Zenfone 8. From what I have read, it shouldn't matter which firmware version it comes with as I understand that it is possible to rollback the firmware version and still use the exploit to unlock the bootloader.
[ASUS ZenFone 8] wike.aj:
I see.. but from experience, ZF8 battery life is horrible. I would not recommend getting this phone unless you don't mind charging it twice a day or if you don't use it heavily
[ASUS ZenFone 8] nasch007:
I've actually had pretty good battery life. Only a few battery draining apps like Outlook and Teams do me in. I could remove them but yeah. Also, it charges insanely fast with the ASUS charger, so if you've got 25 minutes or so you're already back up to 66% or so.

I only ever charge it up to 90% max, though. Usually 80-85 with a charge alarm.

That being said, this phone's company has horrible customer service. I would honestly avoid it just for that.
[ASUS ZenFone 8] MarcelBrouette:
I'm sorry but I not sure to understand what "unlock bootloader" means. I didn't do a thing on my phone but I can properly access to "the boot menu" with "Vol Up/down + power btn", I also have access to the recovery mode and fastboot flash command. However I can't use the "fastboot boot img_file.img" command

When trying to install lineageOs (by flashing boot.img and vendor_boot.img), it broke the phone and even the recovery menu was disabled.

does the bootloader unlocking means accessing the boot menu and being able to sideload or flashing image. Or is it disabling an integrity check of the system before booting it ?

NB: I succeed in flashing an old asus rom so I recover access to the phone.
[ASUS ZenFone 8] platinumthis:
Unlock bootloader means you can flash files that not belong to asus, you can freely alter with the partitions on the phone and flash custom firmware, allowing to modify how YOU want it and possibly brick it by accident