[OnePlus 11] Appreciative:
Hi,

A while back while trying out the OP11 EDL toolset, I noticed there is an Oppo Read Back tool included in the files. It doesn't work out of the box, it requires creating some directories and dropping in the firehose loader to work. Along with the proxy tool to bypass login. That part works all fine when set up properly. Including read back.

However, the format is not something I've seen before and didn't find anything on Google about it either.

Ideally, it would be great if we could adjust or configure this tool to do readback for us to easily and quickly take partition backups (think init_boot, persist style partitions, etc) without root, from a trusted image, and without needing to payload dumper each image.

Right now, when you set everything up and read the phone back, it gives you 5 .orb files. They're from LUN0 and LUN5. They are: misc, rawdump, oplusreserve1, oplusreserve2, oplusreserve5. Each one ends with .orb

One of these orb files, I believe it's opr2, opens with 7zip and you can scroll the contents. While there are some interesting things inside, I do not see any traditional partitions split up into things we would recognize from the old msm tool. Ie: no init_boot, persist etc. However, when you run the tool, you are able to view the logs of the actions and you can see that these partitions are in here. I'm not sure if maybe it needs some EFS exploring or what exactly we can do to obtain an msm-style readback tool for our poking around.

I was able to see some references to these files in one of the other orbs when viewed in hex, but I haven't yet tried any EFS exploring or anything too far yet.

Based on the logs communication stream and logs in general, it feels like there's possibly a config file that's used to tell the tool which partitions and how to save them.

I do not know a way to recombine these .orb files back into an image that can be flashed but it seems like that's also possible in some way(?)

I'm asking for anyone with experience or ideas to chime in and discuss what we may need to do, to achieve this goal.

I won't re-host the software folder as requested by oppo_edl_hacker but I will tell you how I set up the readback tool to function and export these 5 orb files.

The tool itself is located in the 5.5.5 toolset folder.

You will set up the proxy&mitm script just like EDL flashing but add opporeadback.exe to the proxy'd programs list. You auth the same way as using the flash tool. (Select an external region, use any login info and otp code). Then you follow the logs from the button at the bottom. From within those logs, you will see it making calls to files and folders that don't exist. You will need to create these directories/folders and add the appropriate files. Off the top of my head, a folder named Programer (yes, spelled that way) and Qualcomm need to be created. Inside of that, you will drop the firehose in and name it exactly what it says in the logs. You will also need to move another file into place, as you'll find from the logs' path error. The DigestsToSign files.

When you have those in place, and the proxy+mitm running, the readback tool will successfully read back your phone in edl mode into 5 orb files, Lun0&5.

The goal is to find a way to easily obtain partitions from these orbs or to recombine these orbs as a flashable file. I did try to place the 5orbs in a local folder and head back into the flash tool to see if they're automatically recognized as a flashable format and it did not seem to be.

I will attach a screenshot of the readback as it currently stands. If anyone has information on how to achieve the "old style" readback from this tool or these orbs, or knows of a way to recombine them into a flashable image (in which case, we could potentially have flashable images of any version we want, assuming it is doing a full readback), please share. It's possible/likely this tool is taking a backup or sensitive data and partitions. It may not be wise to share the contents of your orbs.

Thanks for any help or information that might help all of us get this figured out. And thanks to those who made the flash tools and proxy/mitm solution available for us to get anywhere.

-Appreciative