First, please don't make the mods come in a clean this thread. Just because I am 99% convinced that it can't be done, doesn't mean that I am right.
Look at my post history concerning H918 ARB1 devices getting root. I had so many ups and downs with that. I was absolutely convinced it couldn't be done because I knew how flashing with laf worked, but then I was absolutely convinced I had it, but I was wrong, and then wash / rinse / repeat about 7 more times -- it was a total roller-coaster.
With that said, I am opening this post to describe what I know to be the process, and ideas as to how it can be circumvented, but maybe I or someone else will see something completely outside the box.
So, I decompiled the classes.dex from TMO_Simlock.apk (don't let the name fool you, it is actually to UNLOCK), and decompiled the modem firmware.
I was wrong about the fact that the modem queries their server on every boot. It reads an SFS registry key:
This is the structure of the message that is sent to the server, and what is received:
Code:
public class TrustletProtocol
implements w
{
private static final int END_TIME_SIZE_BYTES = 4;
private static final int EXPIRY_TIME_OFFSET_BYTES = 332;
private static final int HMAC_SIZE_BYTES = 32;
private static final int IMEI_SIZE_BYTES = 16;
private static final int MAC_SIZE_BYTES = 32;
private static final int MILLS_PER_SECOND = 1000;
private static final int RESPONSE_MESSAGE_LENGTH_OFFSET = 2;
private static final int SERVER_ERROR_MESSAGE_LENGTH_OFFSET = 12;
private static final int SERVER_ERROR_MESSAGE_OFFSET = 16;
public static final String SERVER_URL = "https://unlock.t-mobile.com/unlock/unlock";
private static final int SIGNATURE_SIZE_BYTES = 256;
private static final int SIMLOCK_SETTINGS_LENGTH_BYTES = 4;
private static final int SIMLOCK_SETTINGS_VERSION_MAJOR_OFFSET = 0;
private static final int SIMLOCK_SETTINGS_VERSION_MINOR_OFFSET = 2;
private static final int START_TIME_SIZE_BYTES = 8;
private static final String TAG = TrustletProtocol.class.getName();
private static final int UNLOCK_REQUEST_FIXME = 4;
private static final int UNLOCK_REQUEST_PARTIAL = 3;
private static final int UNLOCK_REQUEST_PERMANENT = 2;
private static final int UNLOCK_REQUEST_RESERVED = 0;
private static final int UNLOCK_REQUEST_TEMPORARY = 1;
private static final byte UNLOCK_SERVER_RESPONSE_TYPE = 40;
private static boolean mSimLockJniLoaded = false;
private n mHttp;
private long mLockedUntil;
private boolean mRebootRequired = false;
private boolean mUseAttestation = true;
private String serverMessage;
The serverMessage is the key that is written to the SFS registry. For those that don't know, the SFS is a protected filesystem that runs in the TrustZone context. You can VIEW it (well at least some (most?) in /persist or /persist-lg, but if you think: "Oh I am just going to go change that as root" watch how quick you (at best) have a broken phone, and at worst, have a brick.
While I was wrong about the modem firmware checking the unlock site on every boot, that was due to looking at the code to quickly. What actually happen is:
Unlock app submits a request -- this request is signed with an RSA cert.
Unlock gets a reply. If you are allowed to unlock, then a key (which is RSA signed) gets written to some untrusted location (haven't found it yet, but knowing where is pointless. Hell it could be written to /data).
A flag gets set instructing the modem to write this key to SFS
When you reboot your phone, the modem (which runs in the TZ so CAN write to SFS) writes the key
Your phone is now unlocked.
I only see one way to make this work -- fool the unlock server into giving you a key.
Even if we could perform a TZ attack so that we could write to SFS, we wouldn't have a SIGNED key.
Now, how do we go about fooling the unlock server into handing us a key? The unlock app has checks that prevent it from doing anything if running on a rooted phone. I don't know how, but even Magisk hide doesn't fix it. I am guessing that it checks if the bootloader is unlocked since I uninstalled Magisk and it still would not do anything (it should return an error that my phone is already unlocked).
Anyway, this can be patched out, and we can get it to run, or hell, figure out the exact message structure that is sent to the server, get a key, and then figure out where it needs to be written, and what flag needs to be set to have the modem write it to SFS (easier to just hack the app ).
Something else interesting in the app:
Code:
public void onCreate(SQLiteDatabase paramSQLiteDatabase)
{
s.a(b, "Crating database for provider: create table history(_id integer primary key autoincrement, action text not null, status integer, stamp integer, until integer, result text not null);");
paramSQLiteDatabase.execSQL("create table history(_id integer primary key autoincrement, action text not null, status integer, stamp integer, until integer, result text not null);");
}
It creates a SQLite database with a single table called 'history'. It looks like this keeps a log of attempts to SIM unlock and the status, and if it is a temp unlock, the time stamp.
I am fairly certain this is useless, just found it interesting. Even with a temp unlock, there must be a key in SFS.
Ideas folks? Before someone says: "Intercept the traffic and make our own key" I will refer you back to the fact that it is RSA signed and we don't have the cert.
-- Brian
I was actually just messing with this the other day on my H918. You mentioned that the SIM Unlock app checks for an unlocked bootloader, but that's not what I found in my experience - I couldn't unlock my device when I flashed 10u + Magisk with TWRP, but a clean wipe and reflash of 10u without any kind of root (but still retaining bootloader unlock + TWRP on recovery partition) allowed me to unlock the device, which I confirmed with a different SIM card.
After unlocking my device, I thought it was permanent (since I selected that option in the app) so I went ahead and flashed Lineage with TWRP, which made me lose the unlock. I suppose this more speaks to the ability of Lineage to read/use the TZ, as opposed to wiping the data since presumably neither TWRP nor Lineage have access to it.
What is exactly your goal for this? Unlocking devices that don't get the thumbs-up from T-Mobile?
Great write-up as usual.
Thanks for the heads up about reflashing 10u, but keeping your bootloader unlocked. I only did an uninstall, so I am guessing something was hanging around that was being detected. Glad I don't have to lock my bootloader to do some tests.
As for you losing the unlock when you flashed Lineage -- that is because it uses the certs that are in the stock ROM (pretty sure it is the same as what is used to verify OTA updates -- but not 100% yet). If that is the case, then you should be able to copy them over to your Lineage install, and the modem will be able to verify the signature of the key that is stored in SFS.
The first step would be to verify that the key is still IN SFS after you flash a non-stock ROM (the modem may delete it from SFS if it can't verify the signature using the public cert). You would have to flash back to stock and check to see if you are still unlocked. If so, then it is just a matter of copying over the appropriate cert to the correct location on the Lineage system image.
Yes, I want to be able to unlock phones that are eligible to be unlocked, but T-Mobile won't do it because you don't have an account with them. I bought an H910 off of eBay, and it was locked. I had verified that the IMEI was clean before buying it. All I had to do was take the phone into an AT&T store, they checked that the IMEI was clean and submitted a ticket. Two days later, I received an unlock code via email.
This is irking the crap out of me that T-Mobile won't do the same thing. It would be VERY easy for them to add the ability for their customer service reps to verify the eligibility and add the IMEI to the unlock site, but NOOOO they want you to have an account to unlock the phone -- that makes no sense. You want to unlock your phone so you can use it on ANOTHER carrier.
-- Brian
runningnak3d said:
First, please don't make the mods come in a clean this thread. Just because I am 99% convinced that it can't be done, doesn't mean that I am right.
Look at my post history concerning H918 ARB1 devices getting root. I had so many ups and downs with that. I was absolutely convinced it couldn't be done because I knew how flashing with laf worked, but then I was absolutely convinced I had it, but I was wrong, and then wash / rinse / repeat about 7 more times -- it was a total roller-coaster.
With that said, I am opening this post to describe what I know to be the process, and ideas as to how it can be circumvented, but maybe I or someone else will see something completely outside the box.
So, I decompiled the classes.dex from TMO_Simlock.apk (don't let the name fool you, it is actually to UNLOCK), and decompiled the modem firmware.
I was wrong about the fact that the modem queries their server on every boot. It reads an SFS registry key:
This is the structure of the message that is sent to the server, and what is received:
Code:
public class TrustletProtocol
implements w
{
private static final int END_TIME_SIZE_BYTES = 4;
private static final int EXPIRY_TIME_OFFSET_BYTES = 332;
private static final int HMAC_SIZE_BYTES = 32;
private static final int IMEI_SIZE_BYTES = 16;
private static final int MAC_SIZE_BYTES = 32;
private static final int MILLS_PER_SECOND = 1000;
private static final int RESPONSE_MESSAGE_LENGTH_OFFSET = 2;
private static final int SERVER_ERROR_MESSAGE_LENGTH_OFFSET = 12;
private static final int SERVER_ERROR_MESSAGE_OFFSET = 16;
public static final String SERVER_URL = "https://unlock.t-mobile.com/unlock/unlock";
private static final int SIGNATURE_SIZE_BYTES = 256;
private static final int SIMLOCK_SETTINGS_LENGTH_BYTES = 4;
private static final int SIMLOCK_SETTINGS_VERSION_MAJOR_OFFSET = 0;
private static final int SIMLOCK_SETTINGS_VERSION_MINOR_OFFSET = 2;
private static final int START_TIME_SIZE_BYTES = 8;
private static final String TAG = TrustletProtocol.class.getName();
private static final int UNLOCK_REQUEST_FIXME = 4;
private static final int UNLOCK_REQUEST_PARTIAL = 3;
private static final int UNLOCK_REQUEST_PERMANENT = 2;
private static final int UNLOCK_REQUEST_RESERVED = 0;
private static final int UNLOCK_REQUEST_TEMPORARY = 1;
private static final byte UNLOCK_SERVER_RESPONSE_TYPE = 40;
private static boolean mSimLockJniLoaded = false;
private n mHttp;
private long mLockedUntil;
private boolean mRebootRequired = false;
private boolean mUseAttestation = true;
private String serverMessage;
The serverMessage is the key that is written to the SFS registry. For those that don't know, the SFS is a protected filesystem that runs in the TrustZone context. You can VIEW it (well at least some (most?) in /persist or /persist-lg, but if you think: "Oh I am just going to go change that as root" watch how quick you (at best) have a broken phone, and at worst, have a brick.
While I was wrong about the modem firmware checking the unlock site on every boot, that was due to looking at the code to quickly. What actually happen is:
Unlock app submits a request -- this request is signed with an RSA cert.
Unlock gets a reply. If you are allowed to unlock, then a key (which is RSA signed) gets written to some untrusted location (haven't found it yet, but knowing where is pointless. Hell it could be written to /data).
A flag gets set instructing the modem to write this key to SFS
When you reboot your phone, the modem (which runs in the TZ so CAN write to SFS) writes the key
Your phone is now unlocked.
I only see one way to make this work -- fool the unlock server into giving you a key.
Even if we could perform a TZ attack so that we could write to SFS, we wouldn't have a SIGNED key.
Now, how do we go about fooling the unlock server into handing us a key? The unlock app has checks that prevent it from doing anything if running on a rooted phone. I don't know how, but even Magisk hide doesn't fix it. I am guessing that it checks if the bootloader is unlocked since I uninstalled Magisk and it still would not do anything (it should return an error that my phone is already unlocked).
Anyway, this can be patched out, and we can get it to run, or hell, figure out the exact message structure that is sent to the server, get a key, and then figure out where it needs to be written, and what flag needs to be set to have the modem write it to SFS (easier to just hack the app ).
Something else interesting in the app:
Code:
public void onCreate(SQLiteDatabase paramSQLiteDatabase)
{
s.a(b, "Crating database for provider: create table history(_id integer primary key autoincrement, action text not null, status integer, stamp integer, until integer, result text not null);");
paramSQLiteDatabase.execSQL("create table history(_id integer primary key autoincrement, action text not null, status integer, stamp integer, until integer, result text not null);");
}
It creates a SQLite database with a single table called 'history'. It looks like this keeps a log of attempts to SIM unlock and the status, and if it is a temp unlock, the time stamp.
I am fairly certain this is useless, just found it interesting. Even with a temp unlock, there must be a key in SFS.
Ideas folks? Before someone says: "Intercept the traffic and make our own key" I will refer you back to the fact that it is RSA signed and we don't have the cert.
-- Brian
Click to expand...
Click to collapse
Brian I can understand that it seems very difficult but I want to give you example of Microsoft Outlook linked with company portal, it was so damn tough to crack everytime it was failed and was also considered impossible, it also sends keys and signatures to server to check root and other stuff even magisk hide wasn't doing anything but it was finally cracked here in XDA and works fine since then, the development was somewhat stopped untill I and few others started to seek help.
One more thing apart from root and all that jazz, let's talk some business stuff. Many times when carriers are left with lots of phones in stock which includes new phones, returned phones etc T Mobile or other carrier don't care to unlock them and are sold in mass when some phones create problem even after network unlocked by either Carrier or seller T Mobile or Verizon etc won't entertain you concerns. See my expample the phone is checked with T Mobile, it's clean, is not reported lost, missing or stolen, no unpaid dues but still T Mobile is not ready to help, and calling USA is quite expensive.
I really have seen those octopus box miracle box unlocking flagship phones even though I am not challenging your belief of 'it can't be unlocked'
Why XDA should focus on carrier unlock is we know how evil
Service provider can become, also these unlock services when paid online they mostly run away with your money or simply you'll have to face their attitude, and if you visit a shop to get it done trust me their attitude is nothing less than a crack seller which really really pisses me off. (please I am not putting every phone repairer in this category).
Another reason to do more research is huge ask amount for unlocking some times $100+, prices are not at all regulated, shady bussiness practices "AND" IF reoccured you will have to pay again.
A rare scenario in which while rooting phone, phone frequency is disturbed and similar situation occurs like carrier unlock and you can't make calls, so if we can have carrier unlock feature it will give more power to people and that what I think XDA is all about.
I hope community will not be prejudiced in finding the solution
Thank you.
Please don't quote the OP ?
Sent from my LG-H910 using XDA Labs
AidenM said:
I was actually just messing with this the other day on my H918. You mentioned that the SIM Unlock app checks for an unlocked bootloader, but that's not what I found in my experience - I couldn't unlock my device when I flashed 10u + Magisk with TWRP, but a clean wipe and reflash of 10u without any kind of root (but still retaining bootloader unlock + TWRP on recovery partition) allowed me to unlock the device, which I confirmed with a different SIM card.
After unlocking my device, I thought it was permanent (since I selected that option in the app) so I went ahead and flashed Lineage with TWRP, which made me lose the unlock. I suppose this more speaks to the ability of Lineage to read/use the TZ, as opposed to wiping the data since presumably neither TWRP nor Lineage have access to it.
What is exactly your goal for this? Unlocking devices that don't get the thumbs-up from T-Mobile?
Great write-up as usual.
Click to expand...
Click to collapse
Your issue resonates mine, my phone when I brought from ebay LGV20 H918 was working with all other sim but when I downgraded it and try to root it got network locked.
My problem is that Octoplus engineer told me I have to clean flash the stock ROM (J version) again the way it should be and then root and then try to unlock with octoPlus suite with purchased server credit, when I tried to reflash the Stock ROM I found that I don't have download mode i.e. the stock recovery which is used by LGUP Tool to flash stock ROM so that's why I was roaming around forum to forum to guide me through steps on how to extract & what to extract from KDZ file to compile a stock recovery image 'WHICH I assume will bring back my stock recovery as I watched OnePlus video in which a guy simply flashed Stock Recovery image through Flashify app and he got the stock recovery back..... (I don't know if that will apply to LGV20 H918).
Is there any other tool which can flash stock ROM and brings back stock recovery.
Could you assist me with noob friendly steps on how you got your phone unlocked.
---------- Post added at 02:48 PM ---------- Previous post was at 02:38 PM ----------
cnjax said:
Please don't quote the OP
Sent from my LG-H910 using XDA Labs
Click to expand...
Click to collapse
Sorry Doc. Noob doing noob things.
runningnak3d said:
Yes, I want to be able to unlock phones that are eligible to be unlocked, but T-Mobile won't do it because you don't have an account with them. I bought an H910 off of eBay, and it was locked. I had verified that the IMEI was clean before buying it. All I had to do was take the phone into an AT&T store, they checked that the IMEI was clean and submitted a ticket. Two days later, I received an unlock code via email.
This is irking the crap out of me that T-Mobile won't do the same thing. It would be VERY easy for them to add the ability for their customer service reps to verify the eligibility and add the IMEI to the unlock site, but NOOOO they want you to have an account to unlock the phone -- that makes no sense. You want to unlock your phone so you can use it on ANOTHER carrier.
-- Brian
Click to expand...
Click to collapse
Well I was in the T-Mobile store when the S5 had just came out. A guy walked in, said he would pay cash up front. Then asked how long it takes to unlock. ( He did not have a T-Mobile account, told them he was with ATT) He was told 3 months.
I guess the policy changed? Or is it depending on who you talk to?
Sent from my LG-H918 using XDA Labs
The only thing that comes to mind would to be dump the message that is sent from a working phone. Preforming a MITM attack is mitigated but the RSA key so you need a way to get message before encryption. I dont own a V20 but I'm assuming this is a system application which means you cannot just change the apk signature and even if you could the signature could be used in checks before it sends data to the server. What I would want to do check the RSA, see if change with every attempt or device or is it static(if reused could be used to decode other messages). The other thing to possibly check is has the device been patched for the Janus vulnerability (CVE-2017-13156). This way maybe you can install a modded apk in a unrooted phone to dump the message to logcat before RSA then compare this your own messages.
Possible PoC
https://github.com/V-E-O/PoC/tree/master/CVE-2017-13156
Hi Brian, I have searched length and breadth of forum and I hope that this can be done but info are scattered too much, some members mentioned and you were also part of recent discussions that such things also occurs while rooting, this is what happened with me, meanwhile I got in touch with my seller and he told me that is was unlocked, there is no lie into it as I was able to make calls, as phone came with P or Q update so as per forum I had to downgrade then it can be rooted. While rooting I observed I have lost the ability to make calls and got network locked, rest story I have narrated how I took it to shop and all that jazz.......
Now what I am really focusing atleast is that I can flash stock in absence of Download mode and damnit I can't find it, here I urge the community to make it only a bit lucid on how to perform so I can further do the steps, it will be helpful for all as this can happen to anyone.
Further-more apart from this topic I am going to file a charge back with paypal for Octopus as they didn't helped me at all even after charging $30 the support really sucks AND AND AND they in chat explicitly wrote that they don't provide services for LG products whereas their software suite had my model, their sales rep in chat suggested that product (software suite here with $30 server credit)
Trust me this whole rooting and network unlock thing will very soon become "DIY ONLY" thing as manufacturer will make phones so hard to root and unlock that any professional will ask money equal to the phone and it is happening I have heard stories that tech support asked for $100+ dollars .
Hope I am making sense here.
Waiting for senior member to involve/intervene and guide.
Thanks.
I know someone in China shenzhen now can easy SIM-unlock T-mobile LG phones or T-mobile Samsung phones.
First, they read the device ID
and then They use IMEI+ HWID to calculate the Freeze code and Net lock code.
It is sha256 + aes
I just do not know where they write the code onto a T-mbile LG phone
asialove2013 said:
I know someone in China shenzhen now can easy SIM-unlock T-mobile LG phones or T-mobile Samsung phones.
First, they read the device ID
and then They use IMEI+ HWID to calculate the Freeze code and Net lock code.
It is sha256 + aes
I just do not know where they write the code onto a T-mbile LG phone
Click to expand...
Click to collapse
See I told that it happens it's just like that we guys at XDA are not able to recreate it. While I am trying what I can I can just see EMI on my credit card statement every month for this phone, your answer atleast is convincing.
Thanks.
Dear Members will this issue be researched further? Plenty of evidence in XDA proves that device can be sim unlocked/ country unlocked, even a member confirmed that someone in China does that. Humble request to all senior members to give it a try without prejudice.
Thank you.
---------- Post added at 01:02 PM ---------- Previous post was at 12:59 PM ----------
asialove2013 said:
I know someone in China shenzhen now can easy SIM-unlock T-mobile LG phones or T-mobile Samsung phones.
First, they read the device ID
and then They use IMEI+ HWID to calculate the Freeze code and Net lock code.
It is sha256 + aes
I just do not know where they write the code onto a T-mbile LG phone
Click to expand...
Click to collapse
Hi could you pm me him phone number? I'll try if something could materialise.
If someone can give me a site that they have PERSONALLY used to unlock their phone, I will get a locked H918 and pay to have it unlocked so I can see the procedure.
I have yet to hear from ONE person that *directly* had their phone unlocked by a service. Everyone that I have heard from has heard a story, or saw a post about a guy that said they had their phone unlocked. Yada, Yada, Yada.
-- Brian
runningnak3d said:
If someone can give me a site that they have PERSONALLY used to unlock their phone, I will get a locked H918 and pay to have it unlocked so I can see the procedure.
I have yet to hear from ONE person that *directly* had their phone unlocked by a service. Everyone that I have heard from has heard a story, or saw a post about a guy that said they had their phone unlocked. Yada, Yada, Yada.
-- Brian
Click to expand...
Click to collapse
Bada Bing I know a guy
Sent from my LG-H910 using XDA Labs
Update:
As I mentioned in a post, I paid for octoPlus $20 'the software suite, it was suppose to do the job, which it didnt, then I was advised to Skype their support they were lazy in replying and eventually said that we don't provide services for LG products so I contacted PayPal and I got the refund (Thank you PayPal)
Another Update.
As I though That I have rooted lots of devices and have seen phones getting carrier unlocked so I will do it and didn't bugged the seller a lot. I talked to seller, called him 3 times he called back and he said "you should have called me about the issue" he said send me the phone I'll get it unlocked he said give me some time, he was polite and humble unlike the shop owner who had attitude of crack peddler.
I'll keep you guys updated no ego thing from my side, if it is fixed I'll get the details here, I know the dents scratches of my phone I have the serial number, IMEI number photographed, so if they fixed the phone or changed the phone I'll update everything here, even if end up looking like jackass because of this, I'll update, this will be a community help and awareness from my side. My mistakes can prevent others to make one.
---------- Post added at 03:37 PM ---------- Previous post was at 03:29 PM ----------
cnjax said:
Bada Bing I know a guy
Sent from my LG-H910 using XDA Labs
Click to expand...
Click to collapse
You know or it was an sarcasm, bad english didn't got your comment well.
@Stallio Thanks for the update. @cnjax was being sarcastic
I am really curious what ends up happening here. Again, not to be a pessimist, but the T-Mobile SIM unlock is unlike ANY other model. They use file that is signed with a 2048 bit RSA key just like the bootloader unlock.bin that you get from LG if you have a US996. Now they may have found a security hole in the modem -- the LG V30 abl had(has?) a massive security hole concerning unlock.bin. You can flash basically anything and it will unlock the bootloader.
So, I am not completely ruling this out, but again, it has to take advantage of some security exploit. It could be an exploit on the unlock server itself, and they fool it into giving a valid unlock file.
Please keep us updated.
EDIT: Someone PMed me a site that claims to be able to SIM unlock the H918 remotely. So, I am going to buy the service, and sniff the network and USB traffic. If it actually SIM unlocks, then I will have all the data I need to implement it.
-- Brian
hello again
runningnak3d said:
@Stallio Thanks for the update. @cnjax was being sarcastic
I am really curious what ends up happening here. Again, not to be a pessimist, but the T-Mobile SIM unlock is unlike ANY other model. They use file that is signed with a 2048 bit RSA key just like the bootloader unlock.bin that you get from LG if you have a US996. Now they may have found a security hole in the modem -- the LG V30 abl had(has?) a massive security hole concerning unlock.bin. You can flash basically anything and it will unlock the bootloader.
So, I am not completely ruling this out, but again, it has to take advantage of some security exploit. It could be an exploit on the unlock server itself, and they fool it into giving a valid unlock file.
Please keep us updated.
EDIT: Someone PMed me a site that claims to be able to SIM unlock the H918 remotely. So, I am going to buy the service, and sniff the network and USB traffic. If it actually SIM unlocks, then I will have all the data I need to implement it.
-- Brian
Click to expand...
Click to collapse
visit lgbbs.com, the website owner said he can unlock T-mobile LG phones
@runningnak3d @asialove2013 its getting really interesting now, waiting to see what comes out after usb and network sniff.
OK, so I was sent yet another site that didn't require the unlock to be done remotely. You install an app with your SIM card out, and put the code they send into their app. It does some magic, and viola, it did SIM unlock the phone.
So, I have network dumps that I have to go through, and I have a full dump of my phone before and immediately after unlocking.
This is definitely not at the top of my priority list, but since it CAN be done, I CAN replicate it. It is my guess just by a quick glance at this packet capture that the "code" that they give has nothing to do with the unlock procedure except as a "you paid for the service, here is your code" to prevent you from sharing the service with others.
They also compiled the APK in debug mode, so it isn't exactly going to be hard to read...
-- Brian
runningnak3d said:
OK, so I was sent yet another site that didn't require the unlock to be done remotely. You install an app with your SIM card out, and put the code they send into their app. It does some magic, and viola, it did SIM unlock the phone.
Click to expand...
Click to collapse
You see how it was possible! No need to use the TMO app.
runningnak3d said:
While I was wrong about the modem firmware checking the unlock site on every boot, that was due to looking at the code to quickly. What actually happen is:
Unlock app submits a request -- this request is signed with an RSA cert.
Unlock gets a reply. If you are allowed to unlock, then a key (which is RSA signed) gets written to some untrusted location (haven't found it yet, but knowing where is pointless. Hell it could be written to /data).
A flag gets set instructing the modem to write this key to SFS
When you reboot your phone, the modem (which runs in the TZ so CAN write to SFS) writes the key
Your phone is now unlocked.
I only see one way to make this work -- fool the unlock server into giving you a key.
Even if we could perform a TZ attack so that we could write to SFS, we wouldn't have a SIGNED key.
Click to expand...
Click to collapse
I agree with you on this! The key is signed on there side, no way to get around this.
Related
I had error ArgumentNullException was unhandled when run my coding.
Code:
public class ImageConverter : IValueConverter
{
public object Convert(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)
{
byte[] buffer = value as byte[];
[B]Stream memStream = new MemoryStream(buffer);[/B]
WriteableBitmap wbimg = PictureDecoder.DecodeJpeg(memStream);
return wbimg;
}
public object ConvertBack(object value, Type targetType, object parameter, System.Globalization.CultureInfo culture)
{
return null;
}
}
The bold line is where the error occur..
Any solution to this error or any other suggestion for me to retrieve image into window phone? Thank you.
Well...
Well, I guess you enter your method with value as null. Your code snippet does of course not show just why value might be null.
Pardon me this innocent question: Why don't you just take the whole thing into the debugger and watch what happens?
Either value is null, or value is not a byte[].
It would be better to just cast it to byte[] instead. That way you would get a different error if it's not a byte[], than if it's null. This would be of some diagnostic value but as another poster mentioned your best bet is to run this in a debugger to see what's going on.
save the image name in database,
Sorry, may i know how to test it in debugger mode?Thank you.
Too early?
hueikar said:
Sorry, may i know how to test it in debugger mode?Thank you.
Click to expand...
Click to collapse
I don't want to offend you, and of course you are free to do whatever you like, but I think it's too early for you to build a full and maybe complicated WP7 app. Do you know the saying "First you have to learn to crawl before you can try to walk"? I think you should learn the fundamentals of using Visual Studio and programming for WP7 from some nice book or online tutorial first.
Even working with complete code samples, as you seem to try, does not help, if you ask me. At least it always was like that when I tried it myself: If in the past I tried to get some code samples to work that I did not understand myself, the first trivial problem already stopped me dead in my tracks. I only had success after my knowledge had progressed to a point where I could read and understand the samples.
Sorry. Yes. I admit that i am too rush to do a win7 app. This is my first time doing window phone app and so with the language c#. But i kinda run out of time to do learning..My first mistake is choose wrong title to do window phone app as my final year project..Luckily so far i manage to do the CRUD for the app.but this is the most difficult problem i am facing now..
Well, in answer to your question, Visual Studio has a Debug button. Select whether you want to debug on the emulator or on your phone (the latter requires that the phone be connected to the PC and Zune be running) and give it a try. If you want to use the media library while debugging, you'll need to use the WPConnect program (it's part of the dev tools, I believe) which allows you to close Zune after you establish the connection, thus unlocking the media library on the phone.
I gotta say I'm a bit surprised by the lack of ambition to get a working 4G toggle. Every phone I've had, there has always been a demand to get a working 4G toggle. Has anyone heard of anything about this? Luckily this phone gets good battery life so its not that big of a deal but it'd be nice to have for those times when your trying to really save battery.
I know of the app Phone Info, but its gotten a lot of negative views around here about losing data with it so I've avoided it since.
rehpyc has been working on one. I've sent him some info that I discovered trying to find the right system call to switch between 3g and 4g.
Rather than simply be disappointed, would you like to help?
Sent from my SCH-I535 using xda premium
I'm trying to find where the settings (which can be accessed in the phone info -> Device Information area) are stored.
-Using dex2jar and jdgui, I decompiled the phone info app into java source (.java) files. It's a really small app that just calls the "TestingSettings" functionality of the SecSettings.apk
-We can access the "TestingSettings" by simply running "am start com.android.settings/.TestingSettings" in terminal. It essentially does the exact same thing as launching the Phone Info app.
-Using dex2jar and jdgui, I decompiled the SecSettings.apk into java source (.java) files. Digging through the files, I found that the RadioInfo class. This class contains a String array mPreferredNetworkLabels which lists all the settings in the spinner we choose the network type (CDMA Auto (PRL), LTE/CDMA/EvDo, etc). This class seems to provide functionality for listening to GUI changes on the "PreferredNetworkType" spinner. Not exactly sure what it does from there, but hopefully it can be traced down to some methods that either store the settings into a file or to a SQLite database.
In dex2jar -> JD gui for SecSettings.apk, Radioinfo class has
public RadioInfo()
{
String[] arrayOfString = new String[14];
arrayOfString[0] = "WCDMA preferred";
arrayOfString[1] = "GSM only";
arrayOfString[2] = "WCDMA only";
arrayOfString[3] = "GSM auto (PRL)";
arrayOfString[4] = "CDMA auto (PRL)";
arrayOfString[5] = "CDMA only";
arrayOfString[6] = "EvDo only";
arrayOfString[7] = "GSM/CDMA auto (PRL)";
arrayOfString[8] = "LTE/CDMA/EvDo";
arrayOfString[9] = "LTE/GSM/WCDMA";
arrayOfString[10] = "Global";
arrayOfString[11] = "LTE only";
arrayOfString[12] = "LTE/WCDMA";
arrayOfString[13] = "Unknown";
this.mPreferredNetworkLabels = arrayOfString;
}
RadioInfo.java sets the network type in the following code (lines 297-309):
AdapterView.OnItemSelectedListener mPreferredNetworkHandler = new AdapterView.OnItemSelectedListener()
{
public void onItemSelected(AdapterView paramAnonymousAdapterView, View paramAnonymousView, int paramAnonymousInt, long paramAnonymousLong)
{
Message localMessage = RadioInfo.this.mHandler.obtainMessage(1001);
if ((paramAnonymousInt >= 0) && (paramAnonymousInt <= -2 + RadioInfo.this.mPreferredNetworkLabels.length))
RadioInfo.this.phone.setPreferredNetworkType(paramAnonymousInt, localMessage);
}
public void onNothingSelected(AdapterView paramAnonymousAdapterView)
{
}
};
The key line is line 303:
RadioInfo.this.phone.setPreferredNetworkType(paramAnonymousInt, localMessage);
Some info about the setPreferredNetworkType() method:
void setPreferredNetworkType(int networkType, Message response);
Requests to set the preferred network type for searching and registering (CS/PS domain, RAT, and operation mode)
Parameters:
networkType one of NT_*_TYPE
response is callback message
The phone data member is a private data member set to null on line 422:
private Phone phone = null;
The phone data member is set to the Default Phone on RadioInfo object creation (onCreate) in line 916:
this.phone = PhoneFactory.getDefaultPhone();
Based on the above information, I believe we would need to create a toggle which would execute a small java program to access the setPreferredNetworkType() method from a Phone object instantiated from the PhoneFactory.getDefaultPhone() method. I believe Phone resides in com.android.internal.telephony, but in order to gain access to the internal android stuff we would need to do something like the following article provides:
https://devmaze.wordpress.com/2011/01/18/using-com-android-internal-part-1-introduction/
That's all the time I have for the moment...
great info! Unfortunately I have no idea how that stuff works. I praise the devs who do this work and members like you who work on it. I wish I could.
Sorry if I came off as demanding of wanting a toggle, I'm just surprised I haven't heard more about it. But good to know it's being worked on. I'd definitely be willing to help test when something is cooked up though
tu3218 said:
great info! Unfortunately I have no idea how that stuff works. I praise the devs who do this work and members like you who work on it. I wish I could.
Sorry if I came off as demanding of wanting a toggle, I'm just surprised I haven't heard more about it. But good to know it's being worked on. I'd definitely be willing to help test when something is cooked up though
Click to expand...
Click to collapse
Unfortunately I'm short on time these days, but I wanted to get the info out there so someone might be able to use it. I really do think we're close, but I'm more of a hacker/modder than an Android dev. Someone comfortable with development on Android might be able to speed this up significantly.
Sent from my SCH-I535 using xda premium
Highlights
Convenient lock screen and home screen widgets provide instant tokencodes without navigating to an app.
Optionally save your PIN.
Supports SDTID files, importing http://127.0.0.1/... tokens from email, and QR tokens.
100% open source (GPLv2+)
Click to expand...
Click to collapse
Requirements
A token seed file from your system administrator
JB 4.1+
Click to expand...
Click to collapse
Downloads
Binaries are attached to this post and available from Google Play.
Source code: https://github.com/cernekee/EasyToken
Click to expand...
Click to collapse
Changelog
Code:
v0.91 - 2014/12/20
- Use more specific MIME type matches so that Easy Token associations don't
show up in Contacts.
- Update libstoken to v0.81 and switch from tomcrypt to nettle. Most of
the changes in v0.8/v0.81 won't matter on Android, but it is now possible
to import hard token seed files if desired.
Older changelogs:
Code:
v0.90 - 2014/07/26
- Rework handling of bound device IDs during token import. Try to guess
it based on the current (unique) device ID and all known class GUIDs.
Allow the user to override it, in case of a collision.
- Limit import string to 64kB to avoid OutOfMemoryError crashes on invalid
tokens.
v0.81 - 2014/07/06
- Fix bug in lock screen widget where it would "bounce" between the tokencode
display and the clock display for no apparent reason
- Show the "confirm import" screen unconditionally, so there is a clear
indication that email import succeeded
v0.80 - 2014/07/05
- Initial public release
Click to expand...
Click to collapse
XDA:DevDB Information
Easy Token, App for all devices (see above for details)
Contributors
cernekee
Source Code: https://github.com/cernekee/EasyToken
Version Information
Status: Beta
Created 2014-07-05
Last Updated 2014-12-21
Attaching a couple of randomly generated tokens, in case it is necessary to test Easy Token without a real seed file. These were created with:
Code:
qrencode -l H `stoken export --random --android` -o v2.png
qrencode -l H `stoken export --file pinless.sdtid --v3` -o v3.png
stoken export --random --sdtid > token.sdtid
The rightmost (denser, v3) QR code is a 6-digit PINless token. You may need to zoom in to scan it.
Verrr niice..
Thanks for making this, it works great and looks much better than the official RSA one. One thing, though, what is the network access permission for?
phigan said:
Thanks for making this, it works great and looks much better than the official RSA one. One thing, though, what is the network access permission for?
Click to expand...
Click to collapse
It isn't currently used, but future uses could include:
Internet token provisioning via CTKIP
NTP clock sync, so that if multiple devices use the same seed, they all read back the same tokencode at the same time
Better problem reporting; currently ACRA is set up to use email but there are some limitations associated with that approach. All problem reporting in this app is user-initiated.
Reported via email as well, but here's the problem I'm having:
Trying to import a token given via an http 127.0.0.1] url in an email:
USER_COMMENT=importing new key via (http link omitted, because xda forums don't like it) failed, with chrome saying "connection refused"
ANDROID_VERSION=4.4.4
APP_VERSION_NAME=0.90
BRAND=oneplus
PHONE_MODEL=A0001
CUSTOM_DATA=
STACK_TRACE=java.lang.Exception: Report requested by developer
at org.acra.ErrorReporter.handleException(ErrorReporter.java:626)
at org.acra.ErrorReporter.handleException(ErrorReporter.java:583)
at app.easytoken.MainActivity.sendProblemReport(MainActivity.java:121)
at app.easytoken.MainActivity.onOptionsItemSelected(MainActivity.java:139)
at android.app.Activity.onMenuItemSelected(Activity.java:2600)
at com.android.internal.policy.impl.PhoneWindow.onMenuItemSelected(PhoneWindow.java:1065)
at com.android.internal.view.menu.MenuBuilder.dispatchMenuItemSelected(MenuBuilder.java:741)
at com.android.internal.view.menu.MenuItemImpl.invoke(MenuItemImpl.java:152)
at com.android.internal.view.menu.MenuBuilder.performItemAction(MenuBuilder.java:884)
at com.android.internal.view.menu.MenuBuilder.performItemAction(MenuBuilder.java:874)
at com.android.internal.view.menu.MenuPopupHelper.onItemClick(MenuPopupHelper.java:177)
at android.widget.AdapterView.performItemClick(AdapterView.java:298)
at android.widget.AbsListView.performItemClick(AbsListView.java:1113)
at android.widget.AbsListView$PerformClick.run(AbsListView.java:2911)
at android.widget.AbsListView$3.run(AbsListView.java:3645)
at android.os.Handler.handleCallback(Handler.java:733)
at android.os.Handler.dispatchMessage(Handler.java:95)
at android.os.Looper.loop(Looper.java:136)
at android.app.ActivityThread.main(ActivityThread.java:5146)
at java.lang.reflect.Method.invokeNative(Native Method)
at java.lang.reflect.Method.invoke(Method.java:515)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:796)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:612)
at dalvik.system.NativeStart.main(Native Method)
Screenshot of Chrome attached.
gehrehmee said:
Trying to import a token given via an http 127.0.0.1] url in an email:
Screenshot of Chrome attached.
Click to expand...
Click to collapse
When you clicked on the email link, did it send you straight to Chrome? Android should notice that the URL matches a pattern that can be handled by two different apps, and let you choose whether to open the link with Chrome (incorrect) or Easy Token (correct).
If this doesn't happen, you may need to clear the default association for Chrome.
If you still can't convince it to pop up the app chooser, another option is to copy the URL to the clipboard (long-press may do it), navigate to Easy Token, then choose Manual Entry.
cernekee said:
When you clicked on the email link, did it send you straight to Chrome? Android should notice that the URL matches a pattern that can be handled by two different apps, and let you choose whether to open the link with Chrome (incorrect) or Easy Token (correct).
If this doesn't happen, you may need to clear the default association for Chrome.
If you still can't convince it to pop up the app chooser, another option is to copy the URL to the clipboard (long-press may do it), navigate to Easy Token, then choose Manual Entry.
Click to expand...
Click to collapse
Interesting:
I installed the official app as well as EasyToken now, and I do get the "choose application" dialog -- but EasyToken isn't in the list.
I copied the URL into the "manual" entry, and it didn't un-grey the "Next" button.
The URL is in the form:
http (noise added to stop xda forum from rejecting post) ://127.0.0.1/securid/ctkip?scheme=https&url=hostname.company.com:443/ctkip/services/CtkipService
gehrehmee said:
The URL is in the form:
http (noise added to stop xda forum from rejecting post) ://127.0.0.1/securid/ctkip?scheme=https&url=hostname.company.com:443/ctkip/services/CtkipService
Click to expand...
Click to collapse
Unfortunately CTKIP is not currently supported. CTKIP URLs do not actually contain the token seed. Instead, they direct the client to handshake with a remote server to securely exchange information. I have not figured out how to implement this scheme yet.
Easy Token normally expects a URL that uses the "compressed token format" (ctf), such as:
Code:
http://127.0.0.1/securid/ctf?ctfData=219561515777421437245254320241301611451327661056547012064173126400766246671676001
The ctf string is entirely self-contained (it doesn't need to talk to a remote server).
Change Device ID
Would it be possible to let users change the device ID? The default one is calculated differently from the official RSA app, so I can't install the same token on both or migrate from one to the other without having a new token issued to me.
pfcrow said:
Would it be possible to let users change the device ID? The default one is calculated differently from the official RSA app, so I can't install the same token on both or migrate from one to the other without having a new token issued to me.
Click to expand...
Click to collapse
If the app is unable to successfully decrypt the token using the default device ID, it should prompt you to enter a different ID (see attached screenshot). You can copy the device ID from the official RSA app if your token is bound to that installation.
Are you getting an error instead?
cernekee said:
If the app is unable to successfully decrypt the token using the default device ID, it should prompt you to enter a different ID (see attached screenshot). You can copy the device ID from the official RSA app if your token is bound to that installation.
Are you getting an error instead?
Click to expand...
Click to collapse
That's awesome! Thanks. I'm also stuck on the CTKIP issue that others discussed above. I suspect I'm not going to have any luck getting the other app to cough up the token once I download it, though.
pfcrow said:
I'm also stuck on the CTKIP issue that others discussed above. I suspect I'm not going to have any luck getting the other app to cough up the token once I download it, though.
Click to expand...
Click to collapse
That's correct - it is stored in a different format, and obfuscated.
I wonder how much demand there would be for an Xposed Framework module that exports stored tokens from the official RSA app?
cernekee said:
That's correct - it is stored in a different format, and obfuscated.
I wonder how much demand there would be for an Xposed Framework module that exports stored tokens from the official RSA app?
Click to expand...
Click to collapse
A lot - my employer will only issue tokens in CTKIP format, and if I can't copy the RSA app's token out I'm stuck with the default app. And what's worse, I'm stuck with using it on just that one phone - this is the whole reason I found your app in the first place, because I have 2 phones and want to clone the token onto both.
If you figure out a way to read the token from the RSA app, I'd happily PayPal you $20 for the effort
Edit: Even better would be an app to extract the RSA token from a Titanium backup.
I am using this on Android and it works great. Today I tried to install this to chrome using ARC. It worked. I was able to import tokens and all seemed well except the tokens are generating the wrong numbers. They should match the android device but they do not. I verified the serial# and dates are the same but the digits after the same PIN numbers are entered are different. I realize ARC is new but figured i'd give it a go.
cernekee said:
That's correct - it is stored in a different format, and obfuscated.
I wonder how much demand there would be for an Xposed Framework module that exports stored tokens from the official RSA app?
Click to expand...
Click to collapse
Was this solved?
I'd love to get more info and give it a go!
It seems a fun challenge. :cyclops:
I gotta tell you - I love this app. I can easily move my token from phone to phone without getting a new token from my sysadmins. That is huge! I wish you a also had a Mac OS X app
Tasker/KLWP
This app is brilliant - so much better than RSA's!
But could you tell me is it possible to get a code from Easy Token into KLWP or Tasker? Using intents?
Cheers!
Great work, loving it !
The token in the official Android app is stored in a sqlite database. If your phone is rooted, it's easy to copy it out and dump the database. You can probably dump it out of any backup program. The problem is that the critical fields are obfuscated. They appear to be 256-bit numbers in hex, and I don't know how they translate into the fields used by stoken (the token program that powers the app we're discussing here).
A dump of the table shows:
Code:
CREATE TABLE tokens (
SERIALNUMBER text primary key not null,
NICKNAME text not null,
EXPIRATIONDATE text not null,
PINTYPE integer not null,
PRNPERIOD integer not null,
PRNLENGTH integer not null,
ROOTSEED blob not null,
OTPMODE integer not null,
DEVICEBINDINGDATA text not null,
ALGORITHM integer not null,
BIRTHDATE integer not null,
MAXTXCOUNT integer not null,
SIGNATURECOUNT integer not null,
LASTTXTIME integer not null,
TOKENHASH blob not null);
The ROOTSEED and TOKENHASH fields are both 64-character (256-bit) hex codes. I think everything else is either zero or reasonably obvious.
My two thoughts are to either make sense of all this data to create a converter, or to investigate the Windows token storage format (which might use the same fields) and see if the official token converter can extract it.
Is any results with CT-KIP? Or any workaround?
I remember that when I used to frequent these forums a year or two ago, there were often times when people would ask why we couldn't use the signing key to get bootloaders or devices to accept arbitrary code. Presumably, the more experienced here understand digital signatures, but maybe not the specific math behind them. This is intended to be a short informational guide on how these work.
Symmetric-key cryptography
The most ubiquitous form of encryption involves keys that are the same for encryption and decryption. This has existed since cryptography first became a thing. Historically, the plebeians of a given polity were illiterate. Only a small portion of society was capable of reading and writing. This is how the Roman Catholic Church held something of a monopoly on the Bible—which was written in Latin, by the way—until printing press lead to increased literacy.
All the people who know a particular key can encrypt and decrypt messages equally. This requires tedious amounts of work to keep the key secret (ergo, "secret key cryptography"). If secret keys are ever implemented on hardware, they must be stored in such a way that attempting to probe for it would simultaneously destroy it. The first iPhone, which lacked hardware-based verification of the bootloader, encrypted the first stage bootloader. If you didn't have the correct key, any code you placed there would decrypt to gibberish (it could presumably still run because it offered no authentication or integrity protection, but the chances of this happening were unlikely). Now, with a MAC algorithm, a tag could be attached for verification purposes, but this would still require having the key burned into the mask ROM.
Asymmetric-key cryptography
Asymmetric cryptography emerged in the 1970s with the Diffie-Hellman protocol—which admittedly wasn't a cryptosystem, but a key agreement protocol—and RSA. RSA is the most widely used public key cryptosystem, but there are others, most being variants on the difficulty of integer factorization or discrete logarithms (i.e., Paillier, Rabin, ElGamal, ECC, DSA, etc.), but there are more exotic ones based on lattices (NTRUEncrypt and NTRUSign), linear codes (McEliece), polynomials (HFE and multivariate cryptography), and hashes (Lamport signatures). There is a public key and private key (sometimes the which is key is which doesn't matter). Crypographic operations with the public key are one way. You can encrypt a message using my public key, but I'm the only who can decrypt it since I generated the key pair.
RSA, the most popular, operates on the fact that with a given exponent and a modulus of secret factorization. An example:
p=41 (prime number)
q=43 (prime number)
N=p*q=1763
e=11 (public exponent)To calculate the private exponent, I must find the number (d) that satisfies e*d mod ((p-1)*(q-1))=1. This number is called a modular multiplicative inverse and it is easy to determine when one knows the factors or N. In this case, d=611. Let's say you want to send me m=10. The ciphertext is c=m^e mod N=10^11 mod 1763=789. To get the message, I only need to calculate swap out my public exponent for my private exponent, giving m=c^d mod N=789^611 mod 1763=10.
These operations can also go the other way, allowing me to "sign" hashes of messages.
Digital signatures
Unlike encryption, signing a message goes the other way and involves using the private key to create a number that can be verified with the public key. With RSA, you just need to do what I did above in reverse. On devices with hardware-based or software-based verifications of code, all that is needed is the public key associated with the identity that is authorized to create runnable code. In a lot of cases, it is burned into the mask ROM of an SoC, allowing no way to change the change anything without some serious molecular rearrangement. If it's in the software, then all you have to do is edit the code that performs the signature check. Seeing as most companies are not stupid, however, this often impossible because that software is verified by a previous stage, with the verification going all the way down to the hardware level.
In the case of UEFI secure boot, the UEFI firmware (which can usually be changed), has a database of public keys that it uses to verify the "first stage" bootloader (in quotes because it's really not the first stage). I don't know if the UEFI firmware is also checked by a previous mechanism, but if it is, it's done in a way that's dissimilar to how ARM-based devices do it.
Questions, comments, concerns? I'm here all day.
Latest Version 0.5.1 (beta)
What is CobaltDebugger? An ARM Processor Simulator/Emulator/Debugger. At its current state, it reads Android bootloader files, and runs them in a simulator, giving you control over which instructions execute and when. For optimal experience, use this in conjunction with IDA Pro.
Hint: Try setting the PC Register to an interesting address found in IDA.
https://youtu.be/cwvz8Cj70Ac <- newer but still old
https://youtu.be/L5NDob2rCmI <- even older
Unzip contents
Run CobaltDebugger.exe
Load up your aboot.mbn or sbl1.mbn
If you want to display referenced strings, open your binary in IDA, go to View > Subviews > Strings, then copy and paste the contents of the strings window into a new text file, then load that text file into CobaltDebugger.
Memory file will grow to 4GB
Click "Load Binary"
Then click "Step Into" or "Run"
You can
- Set breakpoints by address: use >, and < to define break-ranges
- Alter register values, condition flags, psr modes, instruction sets (ARM and Thumb)
Memory edits are not yet implemented but will most likely come as time permits
Page Up, Page Down, Up, and Down keys can be used to navigate the memory viewer - or you can type an address and click "Go" to go there - There's a bug in here somewhere - I'll get to it
The output from the bottom right window is saved as output.xxxxxx.txt, although the file may not get flushed until you click "Unload" or close the application.
All ARM and Thumb instructions were implemented in C# by hand by me. There may be bugs here and there as this is a work in progress and beta. Not all instructions have been implemented so you may encounter a message that states such and such instruction not implemented. If you see that, let me know which instruction and I will implement it as time permits, or you can wait until the next release. I plan on continuing this project until all instructions are implemented.
Originally built with the binaries from the AT&T Samsung Galaxy Note 3 (NC2) in mind, but focus switched to the Verizon Samsung Galaxy S4 (NK1), then back to Note 3 (OC1). This should work with other similar binaries as well.
I'm hoping this will help us discover new ways to unlock bootloaders. But at the very least it's fun to watch the files run.
Change Log 0.5.1
Added image verification steps thanks to Tal Aloni
Bug fixes
More instructions implemented
Slight redesign
Change Log 0.5
Bug fixes, UI improvements, a few more instructions implemented
Now the "Next" instruction is actually the Next instruction as opposed to the most recently executed instruction, so you can see the instruction highlighted BEFORE it executes.
Change Log 0.4.1
Fixed some bugs
Implemented some more instructions
AT&T Note 3 NC2 aboot runs to completion again, although you may find some instructions I've missed if you start jumping around editing the PC value.
Change Log 0.4
Complete refactor
Verizon S4 NK1 aboot runs to completion, although you may find some instructions I've missed if you start jumping around editing the PC value.
Broke some things with the Note 3 aboot instructions
Change Log v0.3:
set default breakpoint for Verizon S4 aboot - Either it's actually *supposed* to start executing code at 0x880C7000 after an MCR and BX instruction, or I may have mis-coded something, but it seems odd, so a breakpoint is set to 0x88E0E4BC until I can figure that one out.
Output to file - C:\temp\output.HHmmss.asm - Now you can review the log after the program has run.
Subscribed. This is going to be epic.
Taking the trash out then going to have some fun hopefully with this.
Next feature to add is the ability to load and run elf files like tz and sdi
v0.2
I Implemented the SP Minus Immediate instruction, which should resolve the NotImplemented exception reported by @dmt010 . I also implemented a bunch more instructions needed by the S4 aboot, although I'm still not done. I went ahead and uploaded an update anyway. This one doesn't blow up like the first version, but rather displays the missing instruction if it encounters one. To skip to a specific address and start executing code, you can modify the PC register and click Apply Edits, then step or run. Sometimes you have to do it twice for it to take, for some reason. If you want to play around with this with your own abootmbn or sbl1.mbn, feel free to post any Not Implemented messages here so I can add them, just make sure no one else has already posted it. Make sure you copy and paste the whole line including the instruction mnemonic and "Pattern" which will help me to identify the desired encoding.
Instruction [Thumb16,LDRB] not implemented. Pattern: [01111iiiiinnnttt]. Address: [0x88E1C470]
Cheers
I just uploaded v0.3. Now it runs the Verizon S4 aboot file without exception until it gets to a section where keeps incorrectly executing ANDEQ R0, R0, #0x3. I know that's not what it is supposed to do, and that it is a result of BX R14, when R14 is holding 0x880C7000, but 0x880C7000 has only zeros because the s4 aboot is running out of context, isolated. Maybe there is supposed to be code at 0x880C7000, ready and waiting to run. Or maybe there was a calculation error in my code and R14 should not have held the value 0x880C7000. I don't know. I will relook at the preceeding steps and make sure the calculations are correct. Might add a unit test or two. I may need to spend more time looking at the line before the branch (MCR p15, 0, R0,c1,c0, 0) MCR was one of the first instructions I implemented months ago. I may need to re-look at that logic and make sure I did it right...
Cobaltikus said:
I just uploaded v0.3. Now it runs the Verizon S4 aboot file without exception until it gets to a section where keeps incorrectly executing ANDEQ R0, R0, #0x3. I know that's not what it is supposed to do, and that it is a result of BX R14, when R14 is holding 0x880C7000, but 0x880C7000 has only zeros because the s4 aboot is running out of context, isolated. Maybe there is supposed to be code at 0x880C7000, ready and waiting to run. Or maybe there was a calculation error in my code and R14 should not have held the value 0x880C7000. I don't know. I will relook at the preceeding steps and make sure the calculations are correct. Might add a unit test or two. I may need to spend more time looking at the line before the branch (MCR p15, 0, R0,c1,c0, 0) MCR was one of the first instructions I implemented months ago. I may need to re-look at that logic and make sure I did it right...
Click to expand...
Click to collapse
What did I say? Glad I snagged the first post, I knew this project would take off.
It is possible that at some point I will consider sharing my source code to the public. But first I need to look into different licensing steps I should take to make sure that if I do release it, it will remain open source and not be stolen and licensed by someone else, forcing me to take my code down, or something else that could be bad for me. I want to make sure that if I do it, I do it right. Another issue for me is that I like to copy and paste the psuedocode from ARM directly into my code, commented, so I have it for reference. I'm fairly certain I would have to take that out before releasing, so I'm not infringing on ARM's copyright policies. But it would be nice to collaborate. Possibly. Maybe.
Cobaltikus said:
... (MCR p15, 0, R0,c1,c0, 0) MCR was one of the first instructions I implemented months ago. I may need to re-look at that logic and make sure I did it right...
Click to expand...
Click to collapse
Yep. I need to re-implement MCR. I wasn't doing all that needed to be done.
v0.4
v0.4 runs Verizon S4 NK1 aboot to completion, and you can view and modify the active Instruction Set (ARM vs Thumb).
v0.5
v0.5
I got a bit side tracked. Thanks to Tal Aloni, Cobalt Debugger now shows and validates the certificate chain and image signature, which started me down the rabbit hole of potentially cracking RSA. When I come back up for air I'll post my latest changes.
ive been trying to crack that thing for months now! haha join in the telegram again for info and we can collaborate live. from what i understand we're dealing with an RSA-SHA1 sig with PKCS#11 padding
Sorry to be somewhat off-topic, but RSA is a method of encryption. So Samsung/Verizon used this to encrypt the bootloader. So if we can crack it, we have access to the bootloader and can Loki it/ another exploit?
Oh yeah, I subbed. I'm teaching myself python and Java(was already on my to do list) to try and offer limited help.
XxD34THxX said:
Sorry to be somewhat off-topic, but RSA is a method of encryption. So Samsung/Verizon used this to encrypt the bootloader. So if we can crack it, we have access to the bootloader and can Loki it/ another exploit?
Oh yeah, I subbed. I'm teaching myself python and Java(was already on my to do list) to try and offer limited help.
Click to expand...
Click to collapse
can you do much with python on android?
What exactly does this thing do ? I"m a bit confused This is some kind of simulator so that you can see how it impacts memory during execution ? But then again, if it can't access hardware then what's the use ? What does it offer over IDA pro ? I'm confused
Not now. Still on the basics of python. I have python and ide on my pc waiting if you need me to test something.
kcarden said:
ive been trying to crack that thing for months now! haha join in the telegram again for info and we can collaborate live. from what i understand we're dealing with an RSA-SHA1 sig with PKCS#11 padding
Click to expand...
Click to collapse
Ah right, getting now what the use of this is As long as stuff is not done in hardware, which it most likely wont be anyway (cause kernel is not up lol) then this could function as a simulator to debug the bootloader. Makes sense
XxD34THxX said:
Sorry to be somewhat off-topic, but RSA is a method of encryption. So Samsung/Verizon used this to encrypt the bootloader. So if we can crack it, we have access to the bootloader and can Loki it/ another exploit?
Oh yeah, I subbed. I'm teaching myself python and Java(was already on my to do list) to try and offer limited help.
Click to expand...
Click to collapse
i've been looking a lot at recovery.img and the recovery partition. and what happens is the image is encrypted and then signed to be accepted by other software sig checks