[OnePlus 11] TraderJack:
Just wanted to chime in here. I'm a potential OP11 owner and before I purchased I wanted to check out to make sure proper tools were available. I wanted to set this up to see if it would work.

First - thanks to all who found this exploit and packaged it here, please don't take the rest of what I write here the wrong way, as I'm sure all OP users are very grateful.

HOWEVER - this writeup seems pretty "messy" for lack of a better word. It would seem that someone figured out how to do this but in relaying the information to others a lot of things got shuffled around and there seems to be quite a bit of confusion and unnecessary steps. For example, it was already established earlier on that running the components on separate machines was not required, only a single machine. However there seems to still be a lot more misinformation/unnecessary work being done.

(In short: You don't need to install (or even RUN) mitmproxy. You don't need Python, and you may not even need a certificate!

Read below for more info....)

I had a really hard time getting this to work (for what was actually a silly reason I'll discuss at the end), but in the meantime I broke apart the pieces and some things seem unnecessary. I'm not a 100% expert, and my observations are just on Windows (11 specifically), but I wanted to point out some things that might help others.

First, a quick explanation of what the pieces of this hack are doing:

1) DownloadTool.exe (from the oppo_edl_hacker_v2_public.zip) - This is the tool to perform the flashes (EDL, etc.). The *problem* (as I understand it, as I am new to OP), is that the functionality of the msm tool which used to be available to all is now locked down to this tool which requires authentication from an authorized user (service center, etc.). The whole point of this procedure is to allow us to login to this tool to use whatever flash files we want on the OP devices. But to do that we need to get it to allow login....

2) mitmproxy (and mitmdump) - These applications allow us to create a proxy so that we can inject code into queries or responses from any applications that are configured to talk through it. The idea here is to configure the DownloadTool to not go directly to the Internet, but rather first through this proxy.

It seems to me that mitmproxy (the main proxy service) is actually NOT REQUIRED AT ALL to get this to work. The only reason it is setup in these guides is to be able to install the mitm certificate. There are much easier ways to do this (if it is even necessary! See below...). For instance, the first time you start mitmdump (or mitmproxy) it will create a folder, by default at:

C:\Users\%usernam%\.mitmproxy

This folder contains all the certificate files. So you don't need to configure your browser to http://mitm.it and follow all that complication. You can simply install the certificate from the local directory via the command line like this:

certutil.exe -user -addstore "root" C:\Users\%username%\.mitmproxy\mitmproxy-ca-cert.cer

Or, click on the .p12 file in that directory and install it into the appropriate store.

You can also change the directory your config files get created in with a command like this:

mitmdump.exe -s scripts\Oppo_EDL_Crack_v2.py --set confdir=.\mitmproxy-10.1.1-windows\config

mitmdump is really the program we need to use here. Think of it as a command line version of mitmproxy. It isn't an interactive viewer like mitmproxy is, but it does allow us to script injections into the code. That is what the Oppo_EDL_Crack_v2.py file is. Basically it make mitmdump listen for certain http requests and then feed back pre-formed responses from the script instead of sending them out to the Internet. This is how we fool DownloadTool into thinking it has properly authenticated a user!

Additionally, despite this being a python script,

Python does not need to be installed in the system.

You don't even need a full mitm install. Just download the binaries from here:

Downloads

mitmproxy.org

Choose the version you want and choose the non "installer" Windows file. It will be a .zip with just 3 executables and it is all you need to run the python script embedded within it.

3) Proxifier - Proxifier solves one specific problem for us: getting DownloadTool to talk through the mitmdump proxy instead of going right out to the Internet. This can be done other ways, but Proxifier is clean and can focus on individual applications instead of the whole system. Basically we set rules in Proxifier that says "Everytime the DownloadTool tries to go out on the network, intercept it and send it to the mitm proxy." That's really all it does, simple but integral!

I tested all of this by downloading only the mitm binaries from the locations above, the portable version of Proxifier (PE), and the Flash Tools folder into a virtual machine.

I was then able to start mitmdump with the .py script and configure the Proxifier rules to simply direct DownloadTool.exe to the mitmdump proxy (running at default 127.0.0.1:8080) and I was able to authenticate into the software.

Note: I do not have a phone on hand, so was unable to perform operations, but I believe as long as login is validated things should work. This may not be correct and someone can correct me here and add additional information.

What else did I discover?

Well, surprisingly it seems that this process works

without even installing the mitm certificate at all

. I also tested this on a fresh VM and was able to login without ever doing any certificate import.

Normally, you can see when the proxy is having certificate issues, because it will often give you a browser authentication error/wanring and also show something like this in the mitmdump window:

However even without the certificate installed, mitmproxy shows the following and DownloadTool properly logs in:

Maybe there is something I am missing here (???) as I am not able to actually go forward with a flash, but in these tests, the certificate is not required for the DownloadTool to properly authenticate.

Now in my operation I could not get DownloadTool to actually download any software. It always reported a timeout with mitmdump logging the following:

I believe this is a known issue and "by design" with this hack. Whether the certificate is installed or not, one simply does not have access to the files on this server.

In short, I do not think you need the mitm certificate installed in order to achieve login to the tool. HOWEVER, if may be required for future operation of the tool which I am unable to validate right now without a phone.

It seems to me all the contents of the Oppo_EDL_Crack_v2.py script are not actually modifying any data to attempt to access unauthorized resources on OPPO/OPs servers, they are simply intercepting authentication requests from DownloadTool and telling it that it sent a good login so it lets you in.

This is an inconvenience, but not a major issue, as is described in the OP it means one simply needs to manually download and install any FW package manually and import it rather than downloading directly from the tool.

One final other note (for now) that might help others concerning why

I had such a hard time getting this working initially

:

Every time I tried to login with the DownloadTool it would hang for 10-15 seconds and then either say "Login Failed!" or sometimes even "Success!", but it would still sit at the login screen and not login. Additionally mitmdump showed:

Well, it turns out that DownloadTool was setup out of the box to us the RCSM-CN server (top dropdown box in tool). This is a server in China which apparently was blocked from my ISP (AT&T Fiber in US). Because of this my server couldn't even reach out to the server at all!

This was solved by simply choosing a different server from the top drop down. I chose "International Version (EU)". You can see in the video in the OP if you look real closely that this is the server selected, but this is not provided or called out in any instruction set! Alternatively, I was able to start my VPN and connect to a server in Singapore and I was able to login with the RCSM-CN server.

Again, all of this was tested by me multiple times and I believe it is all correct and hopefully will help you all whittle down to only what is needed here and not make it more difficult than in needs to be. I welcome any corrections, as we all make mistakes!

- good luck.