we talk about bricked phones .
there will be a no. of people who brick their phones today.
this mainly happens due to wrong bootloader or preloader in mtk.
my question is-
* Why can't we write boatloader after bricking by any method - if i am right manufacturers of phone parts(board or processors) don't write bootloader files, mobile phones companies do it after assembling phones . so there may be a way of writing it again as if they can do it ,why can't we?
they cannot be better than a senior developer(ofcourse i am not talking about me).
gursewak.10 said:
we talk about bricked phones .
there will be a no. of people who brick their phones today.
this mainly happens due to wrong bootloader or preloader in mtk.
my question is-
* Why can't we write boatloader after bricking by any method - if i am right manufacturers of phone parts(board or processors) don't write bootloader files, mobile phones companies do it after assembling phones . so there may be a way of writing it again as if they can do it ,why can't we?
they cannot be better than a senior developer(ofcourse i am not talking about me).
Click to expand...
Click to collapse
Its possible to repair bricked phones. All you need is a e.g. a RIFFBOX for JTAG repair
for nearly every device there are diy to unbrick the phone
It depends on the design. When bootloader allows you to flash important parts of system (e.g., kernel image and /system partition), you can't completely brick you phone by flashing anything but the bootloader. That is, when you "brick" you the phone by flashing something (except the bootloader), you can easily unbrick it by flashing the correct firmware.
(A notable exception is flashing a software that actually destroys the hardware. But this is rare, I think.)
I am not sure if there is a bootloader that does not allow flashing the important parts of the system. I am sure my phone allows it (I flashed bad boot.img many times and recovered then ) and my tablet probably also allows it.
When you, however, do some mistake when flashing a bootloader (either you flash a bad binary or the flashing process is interrupted by a bad cable or power outage in a critical moment), it is hard to recover from it. (As noted, you can use JTAG or something similar, but you can't usually boot the bootloader.) There might be some "dual-bootloader" phones, like there are some dual-BIOS computers, but I am not aware of them. Such phone would have two distinct areas for bootloader. One of them is used, the other is for flashing a new bootloader. When you successfully flash the new bootloader, these areas are effectively swapped. While this would prevent you from some type of issues (e.g. power outage), it does not necessarily prevent you from some others (e.g. accidental flashing a bad file).
gursewak.10 said:
we talk about bricked phones .
there will be a no. of people who brick their phones today.
this mainly happens due to wrong bootloader or preloader in mtk.
my question is-
* Why can't we write boatloader after bricking by any method - if i am right manufacturers of phone parts(board or processors) don't write bootloader files, mobile phones companies do it after assembling phones . so there may be a way of writing it again as if they can do it ,why can't we?
they cannot be better than a senior developer(ofcourse i am not talking about me).
Click to expand...
Click to collapse
Bootloaders are flashed through an IC writer like JTAGGING (RIFFBOX maybe?) (I have seen IC's being written fiest time, like BIOS etc.) ... Thy are not easily erasable (I tried it! Full format through sp flash tool 3 times didn't erase my preloader/bootloader), which if corrupted has to be rewritten by JTAG tool because it is inaccessible .. A senior member or any member can write a bootloader but it needs correct tools. Which vendor has. I have seen this writing process very closely. I have seen hard bricked phones bring repaired (my dad is an electronic engg and has tools at home. I have written my bootloader (OF LGE975) myself after a hard brick it is so easy if you have tools
Instead of thanking me by posting, HIT Thanks if you like my post or if I helped you in any way!
-------------------------------------------
My work:
[TOOL]Kernel/Boot.img (un)packer
Which files are checked by "locked" bootloaders? Want to root locked phone.
//Skip to the last paragraph if you don't care about the context of the question
Hi, I'm looking to get a few applications requiring root onto a device with a locked bootloader. I'm a programmer, but not an android programmer, and my linux skills are only mediocre. Until recently I had an S5 active (also locked) using TWRP and a custom ROM, but the "waterproof" feature didn't work when I fell in a river with it. I've long since forgotten how I managed to get it working, it involved reading threads here for about 2 days until I figured out enough to get it working.
The only specific items I want to install that require root are a whitelist-style firewall and xprivacy. My plan of attack, unless I find anything more promising, is don't immediately allow the new phone (CAT S60) to get updates, get temporary root with dirtycow, then attempt to modify something that is both A) running in root context and B) the bootloader won't complain about. The problem is that I have no idea which things the bootloader is checking.
What I can't figure out is which files are actually "verified" by the bootloader on Android? Just the initramfs? The entire root partition (i.e. everything outside userspace) as well? Is it a short enough checksum that it could be defeated by padding the image until it reaches the same checksum?
yeah let us know if you can get it to root , lot of people are banging their head over this on this forum
aff3p said:
//Skip to the last paragraph if you don't care about the context of the question
Hi, I'm looking to get a few applications requiring root onto a device with a locked bootloader. I'm a programmer, but not an android programmer, and my linux skills are only mediocre. Until recently I had an S5 active (also locked) using TWRP and a custom ROM, but the "waterproof" feature didn't work when I fell in a river with it. I've long since forgotten how I managed to get it working, it involved reading threads here for about 2 days until I figured out enough to get it working.
The only specific items I want to install that require root are a whitelist-style firewall and xprivacy. My plan of attack, unless I find anything more promising, is don't immediately allow the new phone (CAT S60) to get updates, get temporary root with dirtycow, then attempt to modify something that is both A) running in root context and B) the bootloader won't complain about. The problem is that I have no idea which things the bootloader is checking.
What I can't figure out is which files are actually "verified" by the bootloader on Android? Just the initramfs? The entire root partition (i.e. everything outside userspace) as well? Is it a short enough checksum that it could be defeated by padding the image until it reaches the same checksum?
Click to expand...
Click to collapse
I believe it checks the entire /system partition during boot just before/as the kernel loads it to verify whether /system has been modified.
I DO NOT PROVIDE HELP IN PM, KEEP IT IN THE THREADS WHERE EVERYONE CAN SHARE
Hi everyone, this question is for developers who have some bases in hexadecimal programming, I would like to know if it is possible to remove the message after unlocking the bootloader, I had an LG V20 H990DS and I had followed the tutorial on this thread and it was working fine, is there a similar solution for the ROG 5.
[Guide][MOD] Hide unlocked Bootloader warning boot screen
. This fix is for those who want to get rid of the annoying Red Corruption warning screen!!. Disclaimer: You apply the fix at your own risk. I'm not responsible for any software or hardware damage it can lead. The only thing i can assure is...
forum.xda-developers.com
zinou213 said:
Hi everyone, this question is for developers who have some bases in hexadecimal programming, I would like to know if it is possible to remove the message after unlocking the bootloader, I had an LG V20 H990DS and I had followed the tutorial on this thread and it was working fine, is there a similar solution for the ROG 5.
Click to expand...
Click to collapse
That depends. I modified a Teclast T30 bootloader (Mediatek garbage) that forced a delay and printed an orange error message about the bootloader being unlocked. A bit of Arm64 reverse-engineering and I shorted the delay to 0ms (none, basically) and just cut the string short (null-byte) and it works fine on my junker tablet. I've just bought an ASUS ROG Phone 5, getting into it, but I'm nervous about touching anything without, say, TWRP or without knowing how to do a full raw backup and restore.
Yuji Saeki said:
That depends. I modified a Teclast T30 bootloader (Mediatek garbage) that forced a delay and printed an orange error message about the bootloader being unlocked. A bit of Arm64 reverse-engineering and I shorted the delay to 0ms (none, basically) and just cut the string short (null-byte) and it works fine on my junker tablet. I've just bought an ASUS ROG Phone 5, getting into it, but I'm nervous about touching anything without, say, TWRP or without knowing how to do a full raw backup and restore.
Click to expand...
Click to collapse
RAW Firmware Collection and Guide
All fastboot / adb commands require using the side USB-C port https://developer.android.com/studio/releases/platform-tools.html#download Make sure you have fastboot installed Add platform tools to PATH (post 2) Make a backup of anything...
forum.xda-developers.com
There ya go. Good luck
twistedumbrella said:
RAW Firmware Collection and Guide
All fastboot / adb commands require using the side USB-C port https://developer.android.com/studio/releases/platform-tools.html#download Make sure you have fastboot installed Add platform tools to PATH (post 2) Make a backup of anything...
forum.xda-developers.com
There ya go. Good luck
Click to expand...
Click to collapse
Thanks. Just waiting to figure out how to do a raw backup and restore, then I can get to it. If TWRP isn't required to do a raw backup and restore, then I can also begin work on porting TWRP. I've some experience, but not the most when it comes to TWRP porting.
*Edit* I'd like to add, reverse-engineering the ASUS Unlock Tool seems to show the limits on unlocking may be artificial by ASUS. Uses a call-home to fetch data to unlock with. The logic though may be in another castle, I mean package. The FOTA app does the same thing.
*Edit* By the way, does anyone have the exact message that displays about the bootloader being unlocked? I might be able to begin work tracking it down to remove as well as any delay (if there is one).
Some mods target the abl.img (possibly Android Boot Loader) so that may be one place to start. I personally never bother with backups, so I didn't really consider that. All of the data for my apps is synced and everything else is installed from Google Play. I guess that would be a bit more difficult if this were my primary phone.
The text for fussing is in tz.img, or at least it is *one location* with it. But since this is a stupid Tencent version, I can't flash anything to test, otherwise I'd have done it by now. Ah well. Sending the Tencent POS back.
OK , So the possible partitions to see deeper are abl.img and tz.img, can anyone help us with some more informations to remove this annoying message, thanks to all for your participation
Use payload_dumper and a hex editor to compare the original to yours.
Still Waiting for help to remove this message, if anyone has the solution
Hello.
I need someone that has a A125U variante that would like to test crossflashing bettween fimware to bypass U model PBL-unlock-restrictions.
More info, dm me.
EDIT: Changed to GENERAL thread because it turned in to a discussion now.
i have a A125U i can test this out if you want me to
Yes I would be willing to but you would have to walk me through the steps I know nothing of what I'm doing trying to learn
Scotterd said:
Yes I would be willing to but you would have to walk me through the steps I know nothing of what I'm doing trying to learn
Click to expand...
Click to collapse
Download patched odin and flash A125F fimware even if you are on A125U model.
Patched Odin 3.13.1
For those looking for a modified, modded, or patched odin that is a newer build than all the fake and renamed prince comsy 3.12.3 versions floating around. I patch recent Odin versions to offer similar functionality to the princecomsy; in that...
forum.xda-developers.com
Samsung Galaxy A12 Firmware Download SM-A125F Free Download
Samsung Galaxy A12 Firmware Download SM-A125F Free Download ⭐ Official and fast update ⭐ Max speed and free download ⭐ Best Samsung Galaxy website
samfw.com
Clean flashing new fimware useing Odin
DISCLAIMER: I WAS NEVER, HAVE NEVER BEEN, AND WILL NEVER BE RESPONSIBLE OF ANY DAMAGES AGAINST YOUR DEVICES BY YOUR OWN MIS-OPERATIONS # Your warranty is now void # # You have been warned. # # I will laught at you if you point the finger at me...
forum.xda-developers.com
I'm not responsible for any damage don to your device
You can use the patched odin to flash any A12 FW with a matching binary, but it won't affect your ability to unlock the bootloader. The most likely option is to use the EDL method by pulling the back encasing from your phone and using a paperclip or pair of tweezers to short the EDL pin while plugging into your PC. EDL is kind of a secondary bootloader that will allow you to run a variety of functions. Since the A12 is a MediaTek processor, I've tried using the MTKClient exploit through EDL mode to force unlock the bootloader, but so far I haven't seemed to get it working.
R0GUEEE said:
You can use the patched odin to flash any A12 FW with a matching binary, but it won't affect your ability to unlock the bootloader. The most likely option is to use the EDL method by pulling the back encasing from your phone and using a paperclip or pair of tweezers to short the EDL pin while plugging into your PC. EDL is kind of a secondary bootloader that will allow you to run a variety of functions. Since the A12 is a MediaTek processor, I've tried using the MTKClient exploit through EDL mode to force unlock the bootloader, but so far I haven't seemed to get it working.
Click to expand...
Click to collapse
It is possible and a method will be found. It could be that the SBL requires a key for PBL to be unlocked, have you tried useing any exploits on this phone?
LAST_krypton said:
It is possible and a method will be found. It could be that the SBL requires a key for PBL to be unlocked, have you tried useing any exploits on this phone?
Click to expand...
Click to collapse
As far as everything I've tested so far...
Attempted to downgrade A11 to A10 (can't do it because of incompatible FW binaries)
Flashed several different model FWs & various other CSCs... the model I'm using is SM-A125U (AT&T). Currently the FW running on it is for SM-A125U1 (the carrier unlocked model) but of course still no "OEM Unlock" option in dev settings.
After I tried a few dozen builds I looked into EDL/BROM flashing, since EDL works as a ground zero primary boot interface and seems to work as a recovery/fastboot hybrud allowing both flashing & a CMD interface vs a separated Samsung "Download Mode" and Fastboot mode.
I haven't really spent much time scouring the web for different exploits (that aren't paid services) but I did come across "MTKClient" (https://github.com/bkerler/mtkclient), which I was able to successfully run. I tried using the "unlock bootloader" command, at which point it was a "success" and resulted in the device obviously being wiped, but after the following boot there still was no "OEM Unlock" option in the dev menu. Afterwards I tried flashing a custom boot.img built with Magisk, but even using EDL mode to flash, the device wouldn't boot and just gave the basic "this isn't an approved FW" error, so I had to flash the original boot back.
R0GUEEE said:
As far as everything I've tested so far...
Attempted to downgrade A11 to A10 (can't do it because of incompatible FW binaries)
Flashed several different model FWs & various other CSCs... the model I'm using is SM-A125U (AT&T). Currently the FW running on it is for SM-A125U1 (the carrier unlocked model) but of course still no "OEM Unlock" option in dev settings.
After I tried a few dozen builds I looked into EDL/BROM flashing, since EDL works as a ground zero primary boot interface and seems to work as a recovery/fastboot hybrud allowing both flashing & a CMD interface vs a separated Samsung "Download Mode" and Fastboot mode.
I haven't really spent much time scouring the web for different exploits (that aren't paid services) but I did come across "MTKClient" (https://github.com/bkerler/mtkclient), which I was able to successfully run. I tried using the "unlock bootloader" command, at which point it was a "success" and resulted in the device obviously being wiped, but after the following boot there still was no "OEM Unlock" option in the dev menu. Afterwards I tried flashing a custom boot.img built with Magisk, but even using EDL mode to flash, the device wouldn't boot and just gave the basic "this isn't an approved FW" error, so I had to flash the original boot back.
Click to expand...
Click to collapse
You can't downgrade from Android 11 to 10, because Android 10 has a lower SW_REV value. OEM unlocking shouldn't matter if you can force the PBL to be unlocked by a exploit. You can play with date and time settings in the OS and OEM unlocking may come back, as explained here:
Covering some misleading theories and issues with our A12
This thread will be updated regularly. If you don't agree with something comment and if I was proven wrong I will update the thread. Please don't comment or chat here if it isn't releated with something I said. If you need further help with...
forum.xda-developers.com
You can try editing fimware files if you can't find a exploit for downgradeing SW_REV, or you can try from booting in to PRELOADER and with SP_FLASH_TOOL flash Android 10 scattar fimware. This phone is very new so it may be more difficult for finding exploits, you can play with crossflashing fimware and PRELOADER mode. Another thing is that EDL mode is only for snapdragon chipsets.
And try disabeling thoes security locks:
MTK "secure" boot -use mtksecbypass to disable
"Secure" downloads - try MTKClient
LAST_krypton said:
You can't downgrade from Android 11 to 10, because Android 10 has a lower SW_REV value. OEM unlocking shouldn't matter if you can force the PBL to be unlocked by a exploit. You can play with date and time settings in the OS and OEM unlocking may come back, as explained here:
Covering some misleading theories and issues with our A12
This thread will be updated regularly. If you don't agree with something comment and if I was proven wrong I will update the thread. Please don't comment or chat here if it isn't releated with something I said. If you need further help with...
forum.xda-developers.com
You can try editing fimware files if you can't find a exploit for downgradeing SW_REV, or you can try from booting in to PRELOADER and with SP_FLASH_TOOL flash Android 10 scattar fimware. This phone is very new so it may be more difficult for finding exploits, you can play with crossflashing fimware and PRELOADER mode. Another thing is that EDL mode is only for snapdragon chipsets.
Click to expand...
Click to collapse
I just tried flashing twrp lol, obviously didn't work. So with the a125, it runs on a mediatek processor (MT6765) which has the EDL mode if you short the internal pin. I've tested a couple different exploits which "unlock" it, but after flashing anything custom it always boots with "you can't have custom...". So right now I'm just going around in circles
Edit: Right now I'm playing around with Miracle Box to see what all I can accomplish. I'll update if anything new comes along.
R0GUEEE said:
I just tried flashing twrp lol, obviously didn't work. So with the a125, it runs on a mediatek processor (MT6765) which has the EDL mode if you short the internal pin. I've tested a couple different exploits which "unlock" it, but after flashing anything custom it always boots with "you can't have custom...". So right now I'm just going around in circles
Edit: Right now I'm playing around with Miracle Box to see what all I can accomplish. I'll update if anything new comes along.
Click to expand...
Click to collapse
Ok, good luck with Miracle Box, hope you got the one that isn't backdoored...
EDL mode should be only for Snapdragon, mediatek has it's own PRELOADER mode, as I know of it. Some phones have META-MODE. Could be miscommunication bettwen us.
@R0GUEEE
Here I will share these links and documents that could help.
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
How to unlock Unisoc (SPD) bootloader using Identifier Token
This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader
forum.hovatek.com
Where is the "download mode" code stored?
At least Samsung Galaxy series devices support download mode(also known as Odin mode or flash mode) which usually can be accessed by pressing down specific buttons while powering on the phone. Is t...
android.stackexchange.com
How I can downgrade from U3 to U1 "oreo to nougat"
I want to downgrade my phone from Oreo to Nougat My phone is Samsung J730F. But the problem is that Samsung locked the boot-louder. Can I go back by flashing the phone combination ROM then flash my
android.stackexchange.com
http://newandroidbook.com/21-Security.pdf?aboot
Reverse Engineering Android's Aboot
How to use MTK Bypass to backup or flash secure boot MTK
This is a step by step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection A little
forum.hovatek.com
How to use an MTK Secure Boot Download Agent (DA) file
This tutorial will explain how to use that DA file you just downloaded for your Mediatek (MTK) device with Secure Boot. You'll need the DA file to backup, flash, bypass Factory Reset Protection (FRP)
forum.hovatek.com
LAST_krypton said:
@R0GUEEE
Here I will share these links and documents that could help.
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
How to unlock Unisoc (SPD) bootloader using Identifier Token
This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader
forum.hovatek.com
Where is the "download mode" code stored?
At least Samsung Galaxy series devices support download mode(also known as Odin mode or flash mode) which usually can be accessed by pressing down specific buttons while powering on the phone. Is t...
android.stackexchange.com
How I can downgrade from U3 to U1 "oreo to nougat"
I want to downgrade my phone from Oreo to Nougat My phone is Samsung J730F. But the problem is that Samsung locked the boot-louder. Can I go back by flashing the phone combination ROM then flash my
android.stackexchange.com
http://newandroidbook.com/21-Security.pdf?aboot
Reverse Engineering Android's Aboot
How to use MTK Bypass to backup or flash secure boot MTK
This is a step by step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection A little
forum.hovatek.com
How to use an MTK Secure Boot Download Agent (DA) file
This tutorial will explain how to use that DA file you just downloaded for your Mediatek (MTK) device with Secure Boot. You'll need the DA file to backup, flash, bypass Factory Reset Protection (FRP)
forum.hovatek.com
Click to expand...
Click to collapse
Yeah, I've pretty much gone around and around in circles with this. The thing that makes it curious though is after running adb shell getprop and looking through the build, I noticed most of the properties relating to oem unlocking were actually set to allow, the one outlier was sys.oem_unlock_allowed. Which kinda pushes me back towards the KG/RMM. Athough, I'm not sure if that's because I have the unlocked U1 FW flashed (it's actually an a125u), or if its the same on both. Either way, running an MTK exploit to unlock the bootloader (which I've done) doesn't actually contribute anything to whether or not OEM Unlocking is visible in dev settings, which is the primary prereq for unlocking the bootloader.
I did consider trying to update the sys.oem within build.prop in /system, but obviously without a root it's impossible, which lead me to possibly unpacking the stock FW super.img and trying to pre-edit the build within so I could re-pack and flash using the MTK Bypass exploit, but those necessary oem properties aren't even listed on either of the build files I did manage to find.
So as of now I've got one more test I'm going to try before I give up. All things considered, the most likely issue is the KG/RMM state, so I'm going to test a few different methods to try and circumnavigate those and possibly unlock the missing OEM Unlock option.
I can at least say that it's likely not an issue of manufacturer locked loaders, considering that's primarily a snapdragon issue, whereas the A12 runs on MediaTek, so fingers crossed.
R0GUEEE said:
Yeah, I've pretty much gone around and around in circles with this. The thing that makes it curious though is after running adb shell getprop and looking through the build, I noticed most of the properties relating to oem unlocking were actually set to allow, the one outlier was sys.oem_unlock_allowed. Which kinda pushes me back towards the KG/RMM. Athough, I'm not sure if that's because I have the unlocked U1 FW flashed (it's actually an a125u), or if its the same on both. Either way, running an MTK exploit to unlock the bootloader (which I've done) doesn't actually contribute anything to whether or not OEM Unlocking is visible in dev settings, which is the primary prereq for unlocking the bootloader.
I did consider trying to update the sys.oem within build.prop in /system, but obviously without a root it's impossible, which lead me to possibly unpacking the stock FW super.img and trying to pre-edit the build within so I could re-pack and flash using the MTK Bypass exploit, but those necessary oem properties aren't even listed on either of the build files I did manage to find.
So as of now I've got one more test I'm going to try before I give up. All things considered, the most likely issue is the KG/RMM state, so I'm going to test a few different methods to try and circumnavigate those and possibly unlock the missing OEM Unlock option.
I can at least say that it's likely not an issue of manufacturer locked loaders, considering that's primarily a snapdragon issue, whereas the A12 runs on MediaTek, so fingers crossed.
Click to expand...
Click to collapse
If you were able to see the settings are enabled through ADB that is the same as it showing in settings. KG/RMM state could also be the factor of why it isn't beeing shown as of what you have said. Samsung has came a long way with these dumb knox securities which just makes everything worse, you might be able to find a clue for this within their KNOX documents ( I sent a link in a post above). Maybe you can find a profesional, a person that has worked for samsung and can maybe help you with this. It just gets too complicated at one point. If you have telegram or something were we can talk further about this it would be nice because some exploits and stuff if you mention can violate xda rules... So I don't know what else to tell you, I never really was in a situation where I was required to do these type of stuff, only if I had to because of some problems I had. Maybe you can find answers for all of this on some really old forums where people use to do everything to brake apart samsungs and mediateks security locks but still dout it.
For now, hope you learned something and dm me if you want to chat on telegram or etc about this. Don't think something is impossible because you can't find a answer for it, everything is possible.
LAST_krypton said:
If you were able to see the settings are enabled through ADB that is the same as it showing in settings. KG/RMM state could also be the factor of why it isn't beeing shown as of what you have said. Samsung has came a long way with these dumb knox securities which just makes everything worse, you might be able to find a clue for this within their KNOX documents ( I sent a link in a post above). Maybe you can find a profesional, a person that has worked for samsung and can maybe help you with this. It just gets too complicated at one point. If you have telegram or something were we can talk further about this it would be nice because some exploits and stuff if you mention can violate xda rules... So I don't know what else to tell you, I never really was in a situation where I was required to do these type of stuff, only if I had to because of some problems I had. Maybe you can find answers for all of this on some really old forums where people use to do everything to brake apart samsungs and mediateks security locks but still dout it.
For now, hope you learned something and dm me if you want to chat on telegram or etc about this. Don't think something is impossible because you can't find a answer for it, everything is possible.
Click to expand...
Click to collapse
Well after trial and error, I finally got it. I had to hunt down an Android 10 firmware with a matching binary to allow a downgrade, and after a couple of tries, using the auto-date/time method, OEM unlocking finally decided to show itself in dev settings. Specifically, I used this FW, flashed with Odin https://samfw.com/firmware/SM-A125U/USC/A125USQS2AUF3
R0GUEEE said:
Well after trial and error, I finally got it. I had to hunt down an Android 10 firmware with a matching binary to allow a downgrade, and after a couple of tries, using the auto-date/time method, OEM unlocking finally decided to show itself in dev settings. Specifically, I used this FW, flashed with Odin https://samfw.com/firmware/SM-A125U/USC/A125USQS2AUF3
Click to expand...
Click to collapse
Well, you couldev done that allready out of the start. But even do you got OEM_UNLOCKING shown doesn't really mean anything on U model, unless you have exploits and methods for unlocking PBL. Which as said wasn't very sucessful at all for you. I recomend to you that you check our DMs. mtkclient has some bugs which are on the way to be fixed.
I've been working with mtkclient for months, before it even unlocked bootloaders, I was the first to unlock the stylo 6 bootloader and I had a bit of a hand in working out some of the bugs with the tool, I'm doing a full backup of the A125U model right now with mtkclient and after it's done I plan to try the unlock without having oem unlock option in dev options, but first I'll check to see what binary version I'm on, not sure if it's on android 10 or 11 right now. But I will sheet the backup
I finally finished my tutorial for the stylo 6 bootloader unlock and root so now I'm working with the A125U. I'm on 2nd binary and i think i got the bootloader unlocked, but if I flash the patched boot.img it won't boot. I'm gonna try a few ideas i have, so far no luck but I'm not gonna give up, I may crossflash, but I'm trying to find the easiest way to do this.
LAST_krypton said:
@R0GUEEE
Here I will share these links and documents that could help.
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
How to unlock Unisoc (SPD) bootloader using Identifier Token
This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader
forum.hovatek.com
Where is the "download mode" code stored?
At least Samsung Galaxy series devices support download mode(also known as Odin mode or flash mode) which usually can be accessed by pressing down specific buttons while powering on the phone. Is t...
android.stackexchange.com
How I can downgrade from U3 to U1 "oreo to nougat"
I want to downgrade my phone from Oreo to Nougat My phone is Samsung J730F. But the problem is that Samsung locked the boot-louder. Can I go back by flashing the phone combination ROM then flash my
android.stackexchange.com
http://newandroidbook.com/21-Security.pdf?aboot
Reverse Engineering Android's Aboot
How to use MTK Bypass to backup or flash secure boot MTK
This is a step by step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection A little
forum.hovatek.com
How to use an MTK Secure Boot Download Agent (DA) file
This tutorial will explain how to use that DA file you just downloaded for your Mediatek (MTK) device with Secure Boot. You'll need the DA file to backup, flash, bypass Factory Reset Protection (FRP)
forum.hovatek.com
Click to expand...
Click to collapse
GitHub - MTK-bypass/bypass_utility
Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.
github.com
I'm glad to see Hovatek being suggested, i worked with them on my stylo 6 project, they even gave me a shout out if you look in the mtkclient instruction for the K51.
Here's the scatter file for the A125U model
MT6765_A12_scatter.txt
drive.google.com
LAST_krypton said:
Well, you couldev done that allready out of the start. But even do you got OEM_UNLOCKING shown doesn't really mean anything on U model, unless you have exploits and methods for unlocking PBL. Which as said wasn't very sucessful at all for you. I recomend to you that you check our DMs. mtkclient has some bugs which are on the way to be fixed.
Click to expand...
Click to collapse
R0GUEEE said:
Well after trial and error, I finally got it. I had to hunt down an Android 10 firmware with a matching binary to allow a downgrade, and after a couple of tries, using the auto-date/time method, OEM unlocking finally decided to show itself in dev settings. Specifically, I used this FW, flashed with Odin https://samfw.com/firmware/SM-A125U/USC/A125USQS2AUF3
Click to expand...
Click to collapse
I own a a125u with FW A125USQU2BUI3. Would I be able to use this method to make oem unlock appear and then root? If so could you please assist me and help with the steps? I've been attempting to root this thing for a week and my girl friend is starting to hate me because I'm obsessed and paymore attention to this than her lol
I've bought one of those locked Pixel 4As running on ArcaneOS and it's got a locked bootloader but the issue is that like everybody else, I can't do much with the phone. So I'm wondering if there's a way to get a phone into the EDL and then flash the stock firmware through QPST?
Todos123 said:
I've bought one of those locked Pixel 4As running on ArcaneOS and it's got a locked bootloader but the issue is that like everybody else, I can't do much with the phone. So I'm wondering if there's a way to get a phone into the EDL and then flash the stock firmware through QPST?
Click to expand...
Click to collapse
Don't think it's possible as Google doesn't release the firehose (needed by qfil) for pixel phones.
Numerous other device mfg do release the firehose file. Some of them use the same chip as what's in the 4a, but from what I read (I've never tried this), the other mfg file, even though it's for the same chip, won't work.
So ArcaneOS is locking the bootloader and u are now unable to unlock it?
AsItLies said:
Don't think it's possible as Google doesn't release the firehose (needed by qfil) for pixel phones.
Numerous other device mfg do release the firehose file. Some of them use the same chip as what's in the 4a, but from what I read (I've never tried this), the other mfg file, even though it's for the same chip, won't work.
So ArcaneOS is locking the bootloader and u are now unable to unlock it?
Click to expand...
Click to collapse
I've found an mbn file for the pixel 4a and it may be possible to do something with it in qfil (?) but I am unsure. Haven't managed to boot my phone in EDL.
As for the ArcaneOS, I am unsure if it locks the bootloader itself or you need to lock it manually after flashing it. Mine has ArcaneOS installed with no build number which means no access to developer options. There are some articles on pixel phones with this ROM on them and they were apparently used by the FBI undercover agents to sell them to the criminals and catch them.
As of writing this reply, the options for making the device usable are either changing the UFS chip or getting your hands on a broken pixel 4a with a working motherboard. Those usually go from 70 - 100€ from what I've seen. I haven't been able to find one in my country yet.
The issue with changing the UFS chip is that it's hard to find one. I've only found a couple on Ali Express for about 25€. Another issue is that apparently where I live they charge anywhere between 100 - 400€ for a memory chip replacement. What a joke
Todos123 said:
I've found an mbn file for the pixel 4a and it may be possible to do something with it in qfil (?) but I am unsure. Haven't managed to boot my phone in EDL.
As for the ArcaneOS, I am unsure if it locks the bootloader itself or you need to lock it manually after flashing it. Mine has ArcaneOS installed with no build number which means no access to developer options. There are some articles on pixel phones with this ROM on them and they were apparently used by the FBI undercover agents to sell them to the criminals and catch them.
As of writing this reply, the options for making the device usable are either changing the UFS chip or getting your hands on a broken pixel 4a with a working motherboard. Those usually go from 70 - 100€ from what I've seen. I haven't been able to find one in my country yet.
The issue with changing the UFS chip is that it's hard to find one. I've only found a couple on Ali Express for about 25€. Another issue is that apparently where I live they charge anywhere between 100 - 400€ for a memory chip replacement. What a joke
Click to expand...
Click to collapse
edit to add: didn't realize but yes it does look like the proper mbn file *might* allow u to flash stock firmware? Not sure, haven't done it, from what I read the appropriate xml would be needed also... not sure.
... end edit
Just got finished reading the entire Arcane OS thread in same forum. Getting the device into EDL mode shouldn't be a problem, and qualcomm device is capable of that and afaik, it's impossible to defeat that.
but, it's no help if u don't have the programmer firehose file, as u simply can't access the device without it. I've used edl / firehose files for LG devices, but they somehow (the firehose files) become 'leaked' (probably by LG).
But google, nope, I've looked due to the pix 3 (and some others) inadvertently bricking themselves (no one sure why), where u just pick up the device and u have a blank screen. But if u plug it into pc it will connect as QLoader etc (it's basically stuck in edl mode).
But those devices can't be fixed either, same issue in that there's no firehose programmer file for it. So u simply can't access the device.
AsItLies said:
edit to add: didn't realize but yes it does look like the proper mbn file *might* allow u to flash stock firmware? Not sure, haven't done it, from what I read the appropriate xml would be needed also... not sure.
... end edit
Just got finished reading the entire Arcane OS thread in same forum. Getting the device into EDL mode shouldn't be a problem, and qualcomm device is capable of that and afaik, it's impossible to defeat that.
but, it's no help if u don't have the programmer firehose file, as u simply can't access the device without it. I've used edl / firehose files for LG devices, but they somehow (the firehose files) become 'leaked' (probably by LG).
But google, nope, I've looked due to the pix 3 (and some others) inadvertently bricking themselves (no one sure why), where u just pick up the device and u have a blank screen. But if u plug it into pc it will connect as QLoader etc (it's basically stuck in edl mode).
But those devices can't be fixed either, same issue in that there's no firehose programmer file for it. So u simply can't access the device.
Click to expand...
Click to collapse
Ah that's very unfortunate. Well, might as well wait some time. Someone may figure out how to forcefully unlock the bootloader or the firehose file might gets leaked. Who knows... If no, then hopefully I can get a broken pix 4a and just swap the motherboard to my locked one.
Thanks anyways!
Todos123 said:
Ah that's very unfortunate. Well, might as well wait some time. Someone may figure out how to forcefully unlock the bootloader or the firehose file might gets leaked. Who knows... If no, then hopefully I can get a broken pix 4a and just swap the motherboard to my locked one.
Thanks anyways!
Click to expand...
Click to collapse
IMO, the device was flashed with a custom public key to the avb_custom_key partition.