[Honor Magic V2] rabits:
While I wait for the cable I thought to dig around and got some progress with HonorSuite.

The OTA site of Honor is not giving up it's the secrets, so I've installed mitmproxy & proxifier as described in post of @dekefake (as described here: https://xdaforums.com/t/op11-edl-downloadtool-to-restore-your-device-to-oxygenos-coloros.4607995/). Unfortunately, as I quickly figured out, the certs are pinned and doesn't like to be proxied by mitm:

[23:55:02.612][192.168.40.145:57649] client connect[23:55:02.737][192.168.40.145:57649] server connect 43.158.3.142:443
[23:55:03.020][192.168.40.145:57649] Client TLS handshake failed. The client does not trust the proxy's certificate for update.platform.hihonorcloud.com (tlsv1 alert unknown ca)
[23:55:03.022][192.168.40.145:57649] client disconnect
[23:55:03.025][192.168.40.145:57649] server disconnect 43.158.3.142:443

Then I found those certs in HonorSuite's httpcomponent.dll, so prepared a small python script to replace one of the certificates by mitmproxy one:

httpcomponent.dll

#!/usr/bin/env python3
# Patch for HonorSuite to trust any certificate.
# After executing of this script - it's needed to run honorsuite_patch.py,
# which will modify HonorSuite.exe & CommBase.dll to link the right libraries
# Usage: httpcomponent_patch.py <httpcomponent.dll> <cert.crt>

import sys

BUFFER_SIZE = 32*1024 # Have to be bigger then regular certificate size
CERT_BEGIN = "-----BEGIN CERTIFICATE-----".encode()
CERT_END = "-----END CERTIFICATE-----".encode()

def patch_httpcomponent(dll_path, cert_path):
with open(cert_path, 'rb') as f:
new_crt_data = f.read()
new_crt_size = len(new_crt_data)

# Let's copy the binary file and replace the first fit certificate with provided one
old_data = bytes()
# The name httpcomponenb.dll is intentionnaly changed - to keep the checksum happy
with open(dll_path, 'rb') as in_file, open("httpcomponenb.dll", 'wb') as out_file:
crt_start_pos = 0
crt_end_pos = 0
crt_replaced = False
while True:
new_data = in_file.read(BUFFER_SIZE)
combined = old_data+new_data
while not crt_replaced:
start_pos = combined.find(CERT_BEGIN, crt_end_pos-out_file.tell() if crt_end_pos > 0 else 0)
if start_pos == -1:
break
# Found cert beginning, let's find the end
end_pos = combined.find(CERT_END, start_pos)
if end_pos == -1:
# Cert start was found, but the end is not here, leaving for the next round
break

crt_start_pos = out_file.tell() + start_pos
crt_end_pos = out_file.tell() + end_pos + len(CERT_END)
crt_size = crt_end_pos - crt_start_pos
print("Found cert in position {}-{} size: {}b".format(crt_start_pos, crt_end_pos, crt_size))
if new_crt_size <= crt_size:
print("Replacing found certificate by the new one: {}b".format(new_crt_size))

# We need to add zeroes in the end of the new cert to fit the size of old cert
new_crt_data += b"\0"*(crt_size-new_crt_size)
combined = combined[:start_pos] + new_crt_data + combined[end_pos+len(CERT_END):]
old_data = combined[:BUFFER_SIZE]
new_data = combined[BUFFER_SIZE:]
crt_replaced = True
break

out_file.write(old_data)
if not new_data:
break
old_data = new_data

if __name__ == "__main__":
if len(sys.argv) < 3:
print("Error: not enough params provided")
sys.exit(1)

patch_httpcomponent(sys.argv[1], sys.argv[2])

Unfortunately the HonorSuite is protected by checksums and complaints about the fact that I modified it's precious dll. So I used a great work of @IProfessor (https://xdaforums.com/t/hisuite-proxy-huawei-phones-updater-soft-brick-fixer.4082561/) on HiSuite Proxy (HiSuite is effectively the same as HonorSuite) - where he patching 3 binaries, but not replacing the original ones - just stores them in the same directory, so verification mechanisms continue to work - that's just brilliant! And of course I changed the logic a bit and rewrote in relatively simple python script:

honorsuite_patch.py:

#!/usr/bin/env python3
# Patch for HonorSuite to trust any certificate.
# It's second script in a chain - first one is httpcomponent_patch.py
# Usage: honorsuite_patch.py <HonorSuite dir>

import os, sys

def patcher_replace(find_data, replace_data, file_data):
pos = file_data.find(find_data)
if pos == -1:
return False
for i in range(len(replace_data)):
file_data[pos + i] = replace_data[i]
return True

def patch_honorsuite(honorsuite_dir):
# Patch HonorSuite.exe
# Replaces link to httpcomponent.dll to httpcomponenb.dll to keep the checksum happy with original file
find_data = b'httpcomponent.dll'
replace_data = b'httpcomponenb.dll'

# Replaces link to CommBase.dll to CommBaze.dll to keep the checksum happy with original file
find_data2 = b'CommBase.dll'
replace_data2 = b'CommBaze.dll'

with open(os.path.join(honorsuite_dir, "HonorSuite.exe"), 'rb') as f:
file_data = bytearray(f.read())
if patcher_replace(find_data, replace_data, file_data) and patcher_replace(find_data2, replace_data2, file_data):
with open("HonorSuits.exe", 'wb') as f:
f.write(file_data)
print("Patched HonorSuite.exe and stored as HonorSuits.exe")
else:
print("Error patching HonorSuite.exe")

# Patch CommBase.dll
with open(os.path.join(honorsuite_dir, "CommBase.dll"), 'rb') as f:
file_data = bytearray(f.read())
if patcher_replace(find_data, replace_data, file_data):
with open("CommBaze.dll", 'wb') as f:
f.write(file_data)
print("Patched CommBase.dll and stored as CommBaze.dll")
else:
print("Error patching CommBase.dll")

if __name__ == "__main__":
if len(sys.argv) < 2:
print("Error: not enough params provided")
sys.exit(1)

patch_honorsuite(sys.argv[1])

So now, after copying those 3 files into HonorSuite folder I can run HonorSuits.exe and it works and gives up it's secrets: update_request.tgz (attached)

So let's see what's next - maybe there is something really kewl!)