[ASUS ZenFone 8] bnsmb:
Inspired by this blog entry

https://www.pentestpartners.com/sec...id-bootloader-on-the-qualcomm-snapdragon-660/

referenced in this XDA thread

https://xdaforums.com/t/cant-unlock...e-please-try-again-later-24803.4586429/page-2

I have attempted to analyze the bootloader of an ASUS Zenfone 8 using the instructions from the above blog entry. Since the blog entry does not contain details (e.g. exact commands; source URLs for the tools used, etc.), I am documenting my efforts including this information in this forum entry.

It's recommend to read the mentioned blog entry before trying the commands described in this forum entry.

All instructions below are for a PC running the Linux OS.

The boot loader of the ASUS Zenfone 8 is stored in the partition abl_a resp. abl_b

Note:

On my phone the contents of both partitions are equal

1|ASUS_I006D:/ # cksum /sdcard/Download/abl*img
3724543824 1048576 /sdcard/Download/abl_a.img
3724543824 1048576 /sdcard/Download/abl_b.img
ASUS_I006D:/ #

So the first step is to create an image file of one of the abl_* partitions in an adb shell on the ASUS Zenfone 8 as user root:

dd if=/dev/block/by-name/abl_b of=/sdcard/Download/abl_b.img

and copy the image file to the PC for further investigations:

adb pull sdcard/Download/abl_b.img

If this is not possible (e.g. no root access to the phone) you can use the abl partition from one of the original ASUS firmware images for the ASUS Zenfone 8. The image for the abl partition is part of the file payload.bin in the zip file with the OS image. The image for the abl partition is not part of the custom ROM images for the phone.

Next we check the contents of the image file using the binwalk tool (binwalk is part of the Linux OS - at least in Fedora):

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey ] $ binwalk abl_b.img

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
4512 0x11A0 Certificate in DER format (x509 v3), header length: 4, sequence length: 598
5114 0x13FA Certificate in DER format (x509 v3), header length: 4, sequence length: 693
5811 0x16B3 Certificate in DER format (x509 v3), header length: 4, sequence length: 730
12288 0x3000 UEFI PI Firmware Volume, volume size: 589824, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3
12408 0x3078 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 2109640 bytes

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey ] $

The important part here is the UEFI PI Firmware Volume in the partition. To analyze the UEFI partition the tool uefi-firmware-parser can be used. The uefi-firmware-parser is a Python program that can be downloaded from here.

https://github.com/theopolis/uefi-firmware-parser

To install the parser either download the repository from github or install it direct using this command:

sudo pip install uefi_firmware

Then run the parser for the partition image file:

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey ] $ uefi-firmware-parser --superbrute abl_b.img
Error invalid FV header data ().
Error invalid FV header data ().
Firmware Volume: 8c8ce578-8a3d-4f1c-9935-896185c32dd3 attr 0x0003feff, rev 2, cksum 0xf047, size 0x90000 (589824 bytes)
Firmware Volume Blocks: (1152, 0x200)
File 0: 9e21fd93-9c72-4c15-8c4b-e77f1db2d792 type 0x0b, attr 0x00, state 0x07, size 0x47520 (292128 bytes), (firmware volume image)
Section 0: type 0x02, size 0x47508 (292104 bytes) (Guid Defined section)
Guid-Defined: ee4e5898-3914-4259-9d6e-dc7bd79403cf offset= 0x18 attrs= 0x1 (PROCESSING_REQUIRED)
Section 0: type 0x19, size 0x4 (4 bytes) (Raw section)
Section 1: type 0x17, size 0x2030c4 (2109636 bytes) (Firmware volume image section)
Firmware Volume: 8c8ce578-8a3d-4f1c-9935-896185c32dd3 attr 0x0003feff, rev 2, cksum 0x448d, size 0x2030c0 (2109632 bytes)
Firmware Volume Blocks: (32963, 0x40)
File 0: ffffffff-ffff-ffff-ffff-ffffffffffff type 0xf0, attr 0x00, state 0x07, size 0x2c (44 bytes), (ffs padding)
File 1: f536d559-459f-48fa-8bbc-43b554ecae8d type 0x09, attr 0x00, state 0x07, size 0x203038 (2109496 bytes), (application)
Section 0: type 0x15, size 0x1c (28 bytes) (User interface name section)
Name: LinuxLoader
Section 1: type 0x10, size 0x203004 (2109444 bytes) (PE32 image section)
RawObject: size= 446464
[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey ] $

The bootloader is the PE32 image in the partition (PE32 image section).

To extract the PE32 image from the image partition use these commands:

# (optional) create a sub directory for the partition contents
#
mkdir partdetails
cd partdetails

# extract all parts of the partition to separate files
#
uefi-firmware-parser --superbrute -e ../abl_b.img

e.g.

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey/partdetails ] $ uefi-firmware-parser --superbrute -e ../abl_b.img
Error invalid FV header data ().
Error invalid FV header data ().
Firmware Volume: 8c8ce578-8a3d-4f1c-9935-896185c32dd3 attr 0x0003feff, rev 2, cksum 0xf047, size 0x90000 (589824 bytes)
Firmware Volume Blocks: (1152, 0x200)
File 0: 9e21fd93-9c72-4c15-8c4b-e77f1db2d792 type 0x0b, attr 0x00, state 0x07, size 0x47520 (292128 bytes), (firmware volume image)
Section 0: type 0x02, size 0x47508 (292104 bytes) (Guid Defined section)
Guid-Defined: ee4e5898-3914-4259-9d6e-dc7bd79403cf offset= 0x18 attrs= 0x1 (PROCESSING_REQUIRED)
Section 0: type 0x19, size 0x4 (4 bytes) (Raw section)
Section 1: type 0x17, size 0x2030c4 (2109636 bytes) (Firmware volume image section)
Firmware Volume: 8c8ce578-8a3d-4f1c-9935-896185c32dd3 attr 0x0003feff, rev 2, cksum 0x448d, size 0x2030c0 (2109632 bytes)
Firmware Volume Blocks: (32963, 0x40)
File 0: ffffffff-ffff-ffff-ffff-ffffffffffff type 0xf0, attr 0x00, state 0x07, size 0x2c (44 bytes), (ffs padding)
File 1: f536d559-459f-48fa-8bbc-43b554ecae8d type 0x09, attr 0x00, state 0x07, size 0x203038 (2109496 bytes), (application)
Section 0: type 0x15, size 0x1c (28 bytes) (User interface name section)
Name: LinuxLoader
Section 1: type 0x10, size 0x203004 (2109444 bytes) (PE32 image section)
RawObject: size= 446464
Dumping...
Wrote: ./volume-0.fv
Wrote: ./volume-0/filesystem.ffs
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/file.obj
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0.guid
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section0.raw
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1.fv
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf.fv
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf/filesystem.ffs
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf/file-ffffffff-ffff-ffff-ffff-ffffffffffff/file.obj
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf/file-f536d559-459f-48fa-8bbc-43b554ecae8d/file.obj
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf/file-f536d559-459f-48fa-8bbc-43b554ecae8d/section0.ui
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf/file-f536d559-459f-48fa-8bbc-43b554ecae8d/section1.pe
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/guided.preamble
Wrote: ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/guided.certs
Wrote: ./object-1.raw
[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey/partdetails ] $

The file with the bootloader code is the file with the extension .pe. For the next step we just copy it to the parent directory:

cp ./volume-0/file-9e21fd93-9c72-4c15-8c4b-e77f1db2d792/section0/section1/volume-ee4e5898-3914-4259-9d6e-dc7bd79403cf/file-f536d559-459f-48fa-8bbc-43b554ecae8d/section1.pe ..

The file section1.pe can then be disassembled using a disassembler supporting ARM CPUs.

Note:

There is a free version of the disassembler ida (https://hex-rays.com) mentioned in the blog entry - but the freeware version of the current ida version does not support ARM CPUs anymore so we can not use it for this task.

One OpenSource disassembler that supports ARM CPUs is radare2.

https://github.com/radareorg/radare2

radare2 can be downloaded from this web page

https://github.com/radareorg/radare2/releases

radare2 is distributed as sourcecode; just use the instructions on the download page to compile it.

Note:

If the installation script for radare2 fails just switch the working directory to the directory with the source code for radare2 and install it using the command

make install

To start radare2 to disassemble the bootloader use this command

r2 section1.pe

e.g

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey ] $ r2 section1.pe
-- THIS IS NOT A BUG
[0x00011000]>

The main interface for radare2 is a simple CLI shell; to start a text GUI while in the radare2 CLI use the command:

v<enter>

or start radare2 with these parameter

r2 -c v section1.pe

radare2 also supports a Web GUI -- to start radare2 with the WEB GUI use

r2 -c=H section1.pe

e.g.

[ OmniRom 13 Dev - xtrnaw7@t15g /data/develop/android/asuskey ] $ r2 -c=H section1.pe
sh: line 1: http://localhost:9090/m: No such file or directory
Starting http server...
open http://localhost:9090/
r2 -C http://localhost:9090/cmd/

Use the URL http://localhost:9090/ in a WebBrowser to access the WebGUI from radare2.

Notes:

The WebGUI only works out of the box if radare2 is installed in the default directory /usr/local.

For more infos about how to use radare2 see the online help here: https://book.rada.re/index.html

Binary Ninja is another disassembler supporting ARM CPUs. Binary Ninja contains a free online disassembler in the cloud that can be accessed using the URL https://cloud.binary.ninja/ without any local installations.

I'm not really an expert in disassembling ARM code, so I haven't found any magic function in the bootloader so far, but what I already found is the list of supported fastboot oem commands for the ASUS Zenfone 8:

Spoiler content hidden.