Related
Introduction
This is the bootloader unlock from ZTE. It was provided to me in private email by a ZTE engineer.
Warning
This package is for the USA version of the Axon 7 Mini (tulip) running 7.1.1 b14 firmware. If you are running any other device or firmware version, it may not work.
Note
After some testing, it appears that the Axon 7 Mini is not locked in any way. In other words, apparently neither this package nor tuliptool's unlock are required to flash custom ROMs. The only apparent advantage to flashing this is to get access to fastboot, which provides a way to flash a custom boot and recovery (among other things).
Flashing Instructions
Place axon_mini_unlock.zip on the root of your sdcard.
Reboot into recovery.
Select "Apply update from SD card".
Select axon_mini_unlock.zip.
Usage Instructions
After the package is flashed, you may boot into the bootloader:
adb reboot bootloader
Once in the bootloader, you will see an on-screen menu. Additionally, you may access the typical fastboot commands:
fastboot oem device-info
fastboot oem unlock
fastboot flash ...
... etc ...
Download
axon_mini_unlock.zip
md5: ea8f1a21c8a46b3045d00f17a37fe359
So, after this is done, I can flash TWRP through fastboot and tuliptool is no longer necessary, correct?
Yes, that is correct.
JoeGatto said:
So, after this is done, I can flash TWRP through fastboot and tuliptool is no longer necessary, correct?
Click to expand...
Click to collapse
This package is for the USA version of the Axon 7 Mini (tulip) running 7.1.1 b14 firmware. If you are running any other device or firmware version, it may not work.
Click to expand...
Click to collapse
Is this something your contact mentioned or something that you believe based on your experience?
Any harm in trying it on verdandi/other versions without any risk of bricking?
After some testing, it appears that the Axon 7 Mini is not locked in any way. In other words, apparently neither this package nor tuliptool are required to flash custom ROMs. The only apparent advantage to flashing this is to get access to fastboot.
Click to expand...
Click to collapse
Any way to confirm this is also the case with other versions as well?
Thanks TDM.... you're going to have a lot of Canadians asking about verdandi as it is quite cheap here at the moment. Better get those questions out of the way early. The source is released, same kernel version as the U.S. one with some small differences with drivers (from what I can see) and I am sure that if people know that custom roms are possible on that version (not bootloader locked forever) it would be appreciated.
trpn111 said:
Is this something your contact mentioned or something that you believe based on your experience?
Any harm in trying it on verdandi/other versions without any risk of bricking?
Any way to confirm this is also the case with other versions as well?
Thanks TDM.... you're going to have a lot of Canadians asking about verdandi as it is quite cheap here at the moment. Better get those questions out of the way early. The source is released, same kernel version as the U.S. one with some small differences with drivers (from what I can see) and I am sure that if people know that custom roms are possible on that version (not bootloader locked forever) it would be appreciated.
Click to expand...
Click to collapse
Yeah...verdandi is stuck on Marshmellow. But since it has different hardware it could brick if this is tried.
The ZTE engineer is USA based, he is not on the China development team (read: probably a support engineer). He said: "I attached the unlock update zip package, please try it. It is based on B14 build."
Sorry, that's all I have to go by for "official" information.
I do not want to be responsible for anyone bricking their device, so I cannot claim that this bootloader will work with anything other than a tulip device running 7.1.1 b14.
If you want to try and report back, I'm sure others will appreciate it. But I can't be responsible for the results.
trpn111 said:
Is this something your contact mentioned or something that you believe based on your experience?
Any harm in trying it on verdandi/other versions without any risk of bricking?
Any way to confirm this is also the case with other versions as well?
Thanks TDM.... you're going to have a lot of Canadians asking about verdandi as it is quite cheap here at the moment. Better get those questions out of the way early. The source is released, same kernel version as the U.S. one with some small differences with drivers (from what I can see) and I am sure that if people know that custom roms are possible on that version (not bootloader locked forever) it would be appreciated.
Click to expand...
Click to collapse
Oh, and here is some more information to help you decide...
The volume key combo to enter EDL is handled by aboot (bootloader, eg. the thing we are flashing). This means even if you aren't currently able to use the key combo, you should be able to use it with the new aboot here. And if you can get to EDL, you can never really brick the device.
The volume key combo is detected very early in the aboot code. Like, first thing after basic platform init. So even if this isn't compatible with your device, it's likely we could restore the old aboot (assuming you back it up first, of course).
I'm convinced that the tulip is not locked based on my investigation today. So I have no idea if this aboot is properly signed. If your device is locked and this aboot is not signed properly, the lower boot loader won't load it. I'm not quite sure if that kicks you into EDL or not.
Not sure if that makes the decision easier or harder...
How did you come to the conclusion that tulip is not locked to begin with? If we don't need tuliptool or this aboot, how can I check verdandi if the device is the same 'locked but not really locked' state?
I will have a read about backing up aboot and see what I come up with concerning getting into edl.
So here's the deal...
I initially assumed the bootloader was locked because... well... it's supposed to be. So I found the place in aboot code where it checks the lock flag in the devinfo partition. I used the firehose to write unlocked to that flag. Then I built TWRP, flashed it and it booted. So I assumed everything was working just as I expected.
Today, I flashed the aboot with fastboot support and ran "fastboot oem device-info". It said that my device was locked. So I went to look and, sure enough, my devinfo partition flag was still set. Hmm, that's odd.
So I wrote locked back to the flag. TWRP still booted. Now things are looking pretty suspicious.
But maybe the new aboot doesn't even support locking? So I flashed the original b14 version of aboot and TWRP still booted.
That's pretty hard evidence that aboot is ignoring the lock flag. I don't know what they did -- whether they just removed the code that reads the lock flag or introduced a bug or what.
This does not necessarily mean that the lower layers are unlocked. That is, the lower boot loader may still required a properly signed aboot. I don't know, and I'm not ready to brick my device trying to find out.
trpn111 said:
How did you come to the conclusion that tulip is not locked to begin with? If we don't need tuliptool or this aboot, how can I check verdandi if the device is the same 'locked but not really locked' state?
I will have a read about backing up aboot and see what I come up with concerning getting into edl.
Click to expand...
Click to collapse
Hmm... Looks like this package incompatible with ZTE/P852A11/tulip.
Got error while trying to flash it by stock recovery. Error message says that it is for A12 version of tulip.
Ah, yes, you have the euro model. See the "calling all mini owners" thread, posts #76 and #77.
maestromony said:
Hmm... Looks like this package incompatible with ZTE/P852A11/tulip.
Got error while trying to flash it by stock recovery. Error message says that it is for A12 version of tulip.
Click to expand...
Click to collapse
i get a message saying "cant update from sd card?"
yeshivabachur said:
i get a message saying "cant update from sd card?"
Click to expand...
Click to collapse
Make sure battery level is at least 30% before applying any update. It's a standard protection feature.
JoeGatto said:
Make sure battery level is at least 30% before applying any update. It's a standard protection feature.
Click to expand...
Click to collapse
My battery was 80%+ mine still said can't update from sdcard
Aries2010 said:
My battery was 80%+ mine still said can't update from sdcard
Click to expand...
Click to collapse
Try turning on the OEM unlock setting in developer settings.
JoeGatto said:
Try turning on the OEM unlock setting in developer settings.
Click to expand...
Click to collapse
Thank you so much that worked I appreciate the it . Now I have one more question I have been searching for a way to root stock rom but I can't find any instructions on it. Could you walk me through it or post a link for me if possible? I have the USA mini 7 with B14 firmware
Aries2010 said:
Thank you so much that worked I appreciate the it . Now I have one more question I have been searching for a way to root stock rom but I can't find any instructions on it. Could you walk me through it or post a link for me if possible? I have the USA mini 7 with B14 firmware
Click to expand...
Click to collapse
Rooting the stock ROM will require that you remove verity, so that the OS won't refuse to boot once you've made any changes to the system partition. You'll need to use tuliptool to flash a new boot image, which you can find in this section of the forum. Then, you could either install TWRP through fastboot or using tuliptool.
JoeGatto said:
Rooting the stock ROM will require that you remove verity, so that the OS won't refuse to boot once you've made any changes to the system partition. You'll need to use tuliptool to flash a new boot image, which you can find in this section of the forum. Then, you could either install TWRP through fastboot or using tuliptool.
Click to expand...
Click to collapse
Thank you sir I appreciate it I shall try it tomorrow.
here's a stupid question.... I have only dealt with Samsung devices so, I have trouble understanding any other kind of process that is not Samsung. If a new update comes out while my device is bootloader unlocked can i update it? or will it brick my device?
The "standard" (not Samsung) method of updating via OTA is to ship:
1. Full images of any firmware partitions (rpm, tz, aboot, etc.)
2. Full image of boot.
3. A delta (patch) to system.
Also note that custom recoveries generally do not work with vendor OTA's.
This means that if you wish to apply an OTA, you must first have stock recovery and a completely pristine, unmodified system partition. The rest doesn't matter.
yeshivabachur said:
here's a stupid question.... I have only dealt with Samsung devices so, I have trouble understanding any other kind of process that is not Samsung. If a new update comes out while my device is bootloader unlocked can i update it? or will it brick my device?
Click to expand...
Click to collapse
Hi guys,
Newbie here. I've never tinkered with any of my old Nexus phones, but just recently upgraded to the Pixel 2 on Verizon.
According to this thread, I should be able to unlock the bootloader since my build number is OPM1.171019.011 (Android version 8.1.0, December 5th 2017) correct?
I don't know if I want/need to root since I've always been content with stock android. However...
1. Should I unlock the bootloader now, just in case I change my mind in the future?
2. Once I run the first update, I lose the ability to unlock the Verizon bootloader forever right?
3. Can I freely lock and unlock the Verizon bootloader any time afterwards?
4. Will I only receive OTA updates automatically when the bootloader is locked?
Thanks!
SEE BELOW
rickyoo said:
Hi guys,
Newbie here. I've never tinkered with any of my old Nexus phones, but just recently upgraded to the Pixel 2 on Verizon.
According to this thread, I should be able to unlock the bootloader since my build number is OPM1.171019.011 (Android version 8.1.0, December 5th 2017) correct?
I don't know if I want/need to root since I've always been content with stock android. However...
1. Should I unlock the bootloader now, just in case I change my mind in the future? It's entirely up to you, but I would. This would allow you to have the super user flexibility later, even if you decide not to root right now. Also allows you the peace of mind for you to apply the latest android updates, as you will not be able to unlock the bootloader with the patched updates.
2. Once I run the first update, I lose the ability to unlock the Verizon bootloader forever right? YES! NO SOUP FOR YOU!
3. Can I freely lock and unlock the Verizon bootloader any time afterwards? You may lock it again, but beware of the caveats. You will want to be entirely on stock with no modifications. If you have made modifications, and without any way to unlcock the bootloader again, you could end up bricking your device (bootlooping)
You will not be able to unlock the device...see above. NO SOUP FOR YOU!
So just because you can unlock it, doesn't mean that you will forever have the ability to go back and forth. Once it's patched, you lose.... This doesn't apply to the Google versions...just big red
4. Will I only receive OTA updates automatically when the bootloader is locked? technically speacking Bootloader will not effect the ability for updates to be installed. However ROOT'ing your device after your bootloader is unlocked will. So... Here is the link for how to apply updates with and unlocked bootloader https://forum.xda-developers.com/pixel-2/how-to/guide-updating-pixel-2-to-factory-image-t3761154
Thanks!
Click to expand...
Click to collapse
Does this mean that my Verizon Pixel 2, on the current public release of Android 9, cannot enable the "OEM Unlocking" setting in the Developer settings? and therefore I cannot unlock my bootloader?
wo0ts said:
Does this mean that my Verizon Pixel 2, on the current public release of Android 9, cannot enable the "OEM Unlocking" setting in the Developer settings? and therefore I cannot unlock my bootloader?
Click to expand...
Click to collapse
Uhhhh.... correct. See the OP. The command was patched
I believe this article outlines how to unlock after patch
https://alephsecurity.com/2018/01/22/qualcomm-edl-2/
This article outlines how to read all partitions as well as change the dev info partitions. Can someone make a guide to help me use this to allow for oem unlocking?
alecthenice said:
https://alephsecurity.com/2018/01/22/qualcomm-edl-2/
This article outlines how to read all partitions as well as change the dev info partitions. Can someone make a guide to help me use this to allow for oem unlocking?
Click to expand...
Click to collapse
Sure...
1. Build a programmer
2. Develop an exploit to take advantage of a CVE
3. Develop the necessary encrypted signature key to write to the partition
4. Document everything rinse and repeat
In other words there simply no guides out there
BestBuy is selling *NEW* (Verizon) Pixel 2 XLs for $399 at the moment and i was thinking about picking 1 up until a SD855 device I like comes out.
Does the (Verizon) OG PIXEL Rule still apply to the Pixel 2 XL (VZW) that if you 1st boot the device with my TMO SIM, removing the pre-installed VZW SIM, it will register as an UNLOCKED Google Edition Version so I can Unlock the BL as I could with the OG Pixel XL?
I know this is an old thread but I see that there is a GITHUB for this firehorse project.
GitHub - alephsecurity/firehorse: Research & Exploitation framework for Qualcomm EDL Firehose programmers
Research & Exploitation framework for Qualcomm EDL Firehose programmers - GitHub - alephsecurity/firehorse: Research & Exploitation framework for Qualcomm EDL Firehose programmers
github.com
They have target payloads for similar processors, I wonder if someone better at programming would be able to get it working. Banana Hackers has a good repo of EDL files too which might be used as a cross reference perhaps? https://edl.bananahackers.net/
Cprager said:
I know this is an old thread but I see that there is a GITHUB for this firehorse project.
GitHub - alephsecurity/firehorse: Research & Exploitation framework for Qualcomm EDL Firehose programmers
Research & Exploitation framework for Qualcomm EDL Firehose programmers - GitHub - alephsecurity/firehorse: Research & Exploitation framework for Qualcomm EDL Firehose programmers
github.com
They have target payloads for similar processors, I wonder if someone better at programming would be able to get it working. Banana Hackers has a good repo of EDL files too which might be used as a cross reference perhaps? https://edl.bananahackers.net/
Click to expand...
Click to collapse
It's entirely possible. QPST is generally used to flash binary images to the NAND devices, and this functions at the hardware level, so it's entirely possible this could flash an unlocked bootloader.
Hi everyone.
I'm thinking in buying a phone from CAT (CAT S42) and I'm not sure if I can unlock its bootloader. But I've seen on another forum that the CAT S31 has root available for it through Magisk, and I didn't see anyone mentioning having unlocked the bootloader. S42 has a MediaTek chipset and S31 has a Qualcomm chipset, if that helps.
So my question is: is unlocking bootloader MANDATORY to root a device? Can I just run a custom recovery, root the phone with that, and then the recovery gets overwritten on system boot? Or can I root through USB debugging without even needing custom recovery?
The CAT S31 I mentioned was rooted with Magisk, and as I said, I didn't see anyone talking about unlocked bootloader. But I also read Magisk changes the boot partition and the bootloader checks if it was modified. So I'm a bit confused with this too. It's also written that MiracleBox was used and I'm not sure that's the reason that I'm getting confused or not (I had never heard of this tool until now).
A set of software for obtaining ROOT privileges.
Driver_Qualcom_m.7z (9.27 MB) [link]
Enter HS QDSLoad 9008 mode from Vol + and Vol- off state and connect without releasing to USB
MiracleBox [link]
The Boot image is processed on the phone by the Magisk manager, then uploaded to the phone using Miracle again from the computer.
MagiskManager-v7.3.2.apk (2.71 MB) [link]
Just in case,
Backup firmware without / Data partition
Attached files
XposedInstaller_3.1.5-Magisk.apk (2.96 MB) [link]
Click to expand...
Click to collapse
How may they have done that?
I'm sorry, I don't understand a lot of the root requirements part, since I was lucky and my 1st phone had the bootloader unlocked alreaedy for some reason and the second was as easy as writting a single command. But about this phone there's almost nothing and I'd like to know the general about this. If it's really necessary to have the bootloader unlocked, for example. And if it's not, then what methods can I use with it still locked?
Thanks in advance for any help!
Hello DADi590,
Unfortunately I can't answer all of your questions about S42. I have one of them and I am also looking for and confused with root procedures. But I can tell you that unlock boot loader was just a matter of get developer options on (tapping version # 10 times), and inside you can toogle lock/unlock bootloader...
How to root it safely is what I do not know yet.
good luck!
@DADi590
Rooting the Android OS of a device in practice is nothing more than adding the su cmdlet known from Linux OS to the Android OS. To root Android OS in no case requires device's bootloader must get unlocked to do so.
FYI: The bootloader of an Android device is comparable to the BIOS of a Windows computer.
Actually, after some time I decided to leave CAT alone and buy a Blackview one. If I'd break the phone, at least it wouldn't be as expensive as the CAT S42 (I bought a BV9500 - not Pro or Plus, the normal one).
Since then (with help of adventures with a tablet of mine) I've learned some more things. One of them I was suspecting and was now confirmed (thank you @jwoegerbauer) which is to root the device, just a binary file is needed to be on the correct place: su. I didn't know it was on other Linux OSes though. Interesting!
So the idea is that just a recovery must be installed to root a device. That's it and nothing else, I believe. To install the recovery is the part where one might need to unlock the bootloader - or not, if the chipset manufacturer left a tool to write partitions directly, like MediaTek or Rockchip. On these 2 it's possible to write partitions directly with a locked bootloader (this means the bootloader on my 1st phone was and still is probably locked - like my BV9500 one is, and I flashed various partitions on it already, one of them, a TWRP recovery).
This explanation is for anyone else like me who would have this question. Bootloader is just to flash partitions and I think run modified ROMs too, but not too sure about that (I never use custom ROMs). [Btw, if I said something wrong, I'm happy to be corrected!]
armandrix said:
Hello DADi590,
Unfortunately I can't answer all of your questions about S42. I have one of them and I am also looking for and confused with root procedures. But I can tell you that unlock boot loader was just a matter of get developer options on (tapping version # 10 times), and inside you can toogle lock/unlock bootloader...
How to root it safely is what I do not know yet.
good luck!
Click to expand...
Click to collapse
I believe I asked this because I prefer that it's not required to unlock a bootloader to do stuff. If you screw the phone somehow with the bootloader locked and there's no tool to flash partitions on it and you must be on fastboot with an unlocked bootloader or whatever, you just bricked the phone. And I'd prefer that not to happen. That's why I chose to buy phones that don't need me to unlock the bootloader to do anything on them. That might mean I can't ever brick them (at least I never bricked my 1st phone with the various things I did on it which I later found out not being recommended at all XD).
I've unlocked the bootloader on my Cat S42. Can be done.
Hello.
I need someone that has a A125U variante that would like to test crossflashing bettween fimware to bypass U model PBL-unlock-restrictions.
More info, dm me.
EDIT: Changed to GENERAL thread because it turned in to a discussion now.
i have a A125U i can test this out if you want me to
Yes I would be willing to but you would have to walk me through the steps I know nothing of what I'm doing trying to learn
Scotterd said:
Yes I would be willing to but you would have to walk me through the steps I know nothing of what I'm doing trying to learn
Click to expand...
Click to collapse
Download patched odin and flash A125F fimware even if you are on A125U model.
Patched Odin 3.13.1
For those looking for a modified, modded, or patched odin that is a newer build than all the fake and renamed prince comsy 3.12.3 versions floating around. I patch recent Odin versions to offer similar functionality to the princecomsy; in that...
forum.xda-developers.com
Samsung Galaxy A12 Firmware Download SM-A125F Free Download
Samsung Galaxy A12 Firmware Download SM-A125F Free Download ⭐ Official and fast update ⭐ Max speed and free download ⭐ Best Samsung Galaxy website
samfw.com
Clean flashing new fimware useing Odin
DISCLAIMER: I WAS NEVER, HAVE NEVER BEEN, AND WILL NEVER BE RESPONSIBLE OF ANY DAMAGES AGAINST YOUR DEVICES BY YOUR OWN MIS-OPERATIONS # Your warranty is now void # # You have been warned. # # I will laught at you if you point the finger at me...
forum.xda-developers.com
I'm not responsible for any damage don to your device
You can use the patched odin to flash any A12 FW with a matching binary, but it won't affect your ability to unlock the bootloader. The most likely option is to use the EDL method by pulling the back encasing from your phone and using a paperclip or pair of tweezers to short the EDL pin while plugging into your PC. EDL is kind of a secondary bootloader that will allow you to run a variety of functions. Since the A12 is a MediaTek processor, I've tried using the MTKClient exploit through EDL mode to force unlock the bootloader, but so far I haven't seemed to get it working.
R0GUEEE said:
You can use the patched odin to flash any A12 FW with a matching binary, but it won't affect your ability to unlock the bootloader. The most likely option is to use the EDL method by pulling the back encasing from your phone and using a paperclip or pair of tweezers to short the EDL pin while plugging into your PC. EDL is kind of a secondary bootloader that will allow you to run a variety of functions. Since the A12 is a MediaTek processor, I've tried using the MTKClient exploit through EDL mode to force unlock the bootloader, but so far I haven't seemed to get it working.
Click to expand...
Click to collapse
It is possible and a method will be found. It could be that the SBL requires a key for PBL to be unlocked, have you tried useing any exploits on this phone?
LAST_krypton said:
It is possible and a method will be found. It could be that the SBL requires a key for PBL to be unlocked, have you tried useing any exploits on this phone?
Click to expand...
Click to collapse
As far as everything I've tested so far...
Attempted to downgrade A11 to A10 (can't do it because of incompatible FW binaries)
Flashed several different model FWs & various other CSCs... the model I'm using is SM-A125U (AT&T). Currently the FW running on it is for SM-A125U1 (the carrier unlocked model) but of course still no "OEM Unlock" option in dev settings.
After I tried a few dozen builds I looked into EDL/BROM flashing, since EDL works as a ground zero primary boot interface and seems to work as a recovery/fastboot hybrud allowing both flashing & a CMD interface vs a separated Samsung "Download Mode" and Fastboot mode.
I haven't really spent much time scouring the web for different exploits (that aren't paid services) but I did come across "MTKClient" (https://github.com/bkerler/mtkclient), which I was able to successfully run. I tried using the "unlock bootloader" command, at which point it was a "success" and resulted in the device obviously being wiped, but after the following boot there still was no "OEM Unlock" option in the dev menu. Afterwards I tried flashing a custom boot.img built with Magisk, but even using EDL mode to flash, the device wouldn't boot and just gave the basic "this isn't an approved FW" error, so I had to flash the original boot back.
R0GUEEE said:
As far as everything I've tested so far...
Attempted to downgrade A11 to A10 (can't do it because of incompatible FW binaries)
Flashed several different model FWs & various other CSCs... the model I'm using is SM-A125U (AT&T). Currently the FW running on it is for SM-A125U1 (the carrier unlocked model) but of course still no "OEM Unlock" option in dev settings.
After I tried a few dozen builds I looked into EDL/BROM flashing, since EDL works as a ground zero primary boot interface and seems to work as a recovery/fastboot hybrud allowing both flashing & a CMD interface vs a separated Samsung "Download Mode" and Fastboot mode.
I haven't really spent much time scouring the web for different exploits (that aren't paid services) but I did come across "MTKClient" (https://github.com/bkerler/mtkclient), which I was able to successfully run. I tried using the "unlock bootloader" command, at which point it was a "success" and resulted in the device obviously being wiped, but after the following boot there still was no "OEM Unlock" option in the dev menu. Afterwards I tried flashing a custom boot.img built with Magisk, but even using EDL mode to flash, the device wouldn't boot and just gave the basic "this isn't an approved FW" error, so I had to flash the original boot back.
Click to expand...
Click to collapse
You can't downgrade from Android 11 to 10, because Android 10 has a lower SW_REV value. OEM unlocking shouldn't matter if you can force the PBL to be unlocked by a exploit. You can play with date and time settings in the OS and OEM unlocking may come back, as explained here:
Covering some misleading theories and issues with our A12
This thread will be updated regularly. If you don't agree with something comment and if I was proven wrong I will update the thread. Please don't comment or chat here if it isn't releated with something I said. If you need further help with...
forum.xda-developers.com
You can try editing fimware files if you can't find a exploit for downgradeing SW_REV, or you can try from booting in to PRELOADER and with SP_FLASH_TOOL flash Android 10 scattar fimware. This phone is very new so it may be more difficult for finding exploits, you can play with crossflashing fimware and PRELOADER mode. Another thing is that EDL mode is only for snapdragon chipsets.
And try disabeling thoes security locks:
MTK "secure" boot -use mtksecbypass to disable
"Secure" downloads - try MTKClient
LAST_krypton said:
You can't downgrade from Android 11 to 10, because Android 10 has a lower SW_REV value. OEM unlocking shouldn't matter if you can force the PBL to be unlocked by a exploit. You can play with date and time settings in the OS and OEM unlocking may come back, as explained here:
Covering some misleading theories and issues with our A12
This thread will be updated regularly. If you don't agree with something comment and if I was proven wrong I will update the thread. Please don't comment or chat here if it isn't releated with something I said. If you need further help with...
forum.xda-developers.com
You can try editing fimware files if you can't find a exploit for downgradeing SW_REV, or you can try from booting in to PRELOADER and with SP_FLASH_TOOL flash Android 10 scattar fimware. This phone is very new so it may be more difficult for finding exploits, you can play with crossflashing fimware and PRELOADER mode. Another thing is that EDL mode is only for snapdragon chipsets.
Click to expand...
Click to collapse
I just tried flashing twrp lol, obviously didn't work. So with the a125, it runs on a mediatek processor (MT6765) which has the EDL mode if you short the internal pin. I've tested a couple different exploits which "unlock" it, but after flashing anything custom it always boots with "you can't have custom...". So right now I'm just going around in circles
Edit: Right now I'm playing around with Miracle Box to see what all I can accomplish. I'll update if anything new comes along.
R0GUEEE said:
I just tried flashing twrp lol, obviously didn't work. So with the a125, it runs on a mediatek processor (MT6765) which has the EDL mode if you short the internal pin. I've tested a couple different exploits which "unlock" it, but after flashing anything custom it always boots with "you can't have custom...". So right now I'm just going around in circles
Edit: Right now I'm playing around with Miracle Box to see what all I can accomplish. I'll update if anything new comes along.
Click to expand...
Click to collapse
Ok, good luck with Miracle Box, hope you got the one that isn't backdoored...
EDL mode should be only for Snapdragon, mediatek has it's own PRELOADER mode, as I know of it. Some phones have META-MODE. Could be miscommunication bettwen us.
@R0GUEEE
Here I will share these links and documents that could help.
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
How to unlock Unisoc (SPD) bootloader using Identifier Token
This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader
forum.hovatek.com
Where is the "download mode" code stored?
At least Samsung Galaxy series devices support download mode(also known as Odin mode or flash mode) which usually can be accessed by pressing down specific buttons while powering on the phone. Is t...
android.stackexchange.com
How I can downgrade from U3 to U1 "oreo to nougat"
I want to downgrade my phone from Oreo to Nougat My phone is Samsung J730F. But the problem is that Samsung locked the boot-louder. Can I go back by flashing the phone combination ROM then flash my
android.stackexchange.com
http://newandroidbook.com/21-Security.pdf?aboot
Reverse Engineering Android's Aboot
How to use MTK Bypass to backup or flash secure boot MTK
This is a step by step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection A little
forum.hovatek.com
How to use an MTK Secure Boot Download Agent (DA) file
This tutorial will explain how to use that DA file you just downloaded for your Mediatek (MTK) device with Secure Boot. You'll need the DA file to backup, flash, bypass Factory Reset Protection (FRP)
forum.hovatek.com
LAST_krypton said:
@R0GUEEE
Here I will share these links and documents that could help.
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
How to unlock Unisoc (SPD) bootloader using Identifier Token
This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader
forum.hovatek.com
Where is the "download mode" code stored?
At least Samsung Galaxy series devices support download mode(also known as Odin mode or flash mode) which usually can be accessed by pressing down specific buttons while powering on the phone. Is t...
android.stackexchange.com
How I can downgrade from U3 to U1 "oreo to nougat"
I want to downgrade my phone from Oreo to Nougat My phone is Samsung J730F. But the problem is that Samsung locked the boot-louder. Can I go back by flashing the phone combination ROM then flash my
android.stackexchange.com
http://newandroidbook.com/21-Security.pdf?aboot
Reverse Engineering Android's Aboot
How to use MTK Bypass to backup or flash secure boot MTK
This is a step by step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection A little
forum.hovatek.com
How to use an MTK Secure Boot Download Agent (DA) file
This tutorial will explain how to use that DA file you just downloaded for your Mediatek (MTK) device with Secure Boot. You'll need the DA file to backup, flash, bypass Factory Reset Protection (FRP)
forum.hovatek.com
Click to expand...
Click to collapse
Yeah, I've pretty much gone around and around in circles with this. The thing that makes it curious though is after running adb shell getprop and looking through the build, I noticed most of the properties relating to oem unlocking were actually set to allow, the one outlier was sys.oem_unlock_allowed. Which kinda pushes me back towards the KG/RMM. Athough, I'm not sure if that's because I have the unlocked U1 FW flashed (it's actually an a125u), or if its the same on both. Either way, running an MTK exploit to unlock the bootloader (which I've done) doesn't actually contribute anything to whether or not OEM Unlocking is visible in dev settings, which is the primary prereq for unlocking the bootloader.
I did consider trying to update the sys.oem within build.prop in /system, but obviously without a root it's impossible, which lead me to possibly unpacking the stock FW super.img and trying to pre-edit the build within so I could re-pack and flash using the MTK Bypass exploit, but those necessary oem properties aren't even listed on either of the build files I did manage to find.
So as of now I've got one more test I'm going to try before I give up. All things considered, the most likely issue is the KG/RMM state, so I'm going to test a few different methods to try and circumnavigate those and possibly unlock the missing OEM Unlock option.
I can at least say that it's likely not an issue of manufacturer locked loaders, considering that's primarily a snapdragon issue, whereas the A12 runs on MediaTek, so fingers crossed.
R0GUEEE said:
Yeah, I've pretty much gone around and around in circles with this. The thing that makes it curious though is after running adb shell getprop and looking through the build, I noticed most of the properties relating to oem unlocking were actually set to allow, the one outlier was sys.oem_unlock_allowed. Which kinda pushes me back towards the KG/RMM. Athough, I'm not sure if that's because I have the unlocked U1 FW flashed (it's actually an a125u), or if its the same on both. Either way, running an MTK exploit to unlock the bootloader (which I've done) doesn't actually contribute anything to whether or not OEM Unlocking is visible in dev settings, which is the primary prereq for unlocking the bootloader.
I did consider trying to update the sys.oem within build.prop in /system, but obviously without a root it's impossible, which lead me to possibly unpacking the stock FW super.img and trying to pre-edit the build within so I could re-pack and flash using the MTK Bypass exploit, but those necessary oem properties aren't even listed on either of the build files I did manage to find.
So as of now I've got one more test I'm going to try before I give up. All things considered, the most likely issue is the KG/RMM state, so I'm going to test a few different methods to try and circumnavigate those and possibly unlock the missing OEM Unlock option.
I can at least say that it's likely not an issue of manufacturer locked loaders, considering that's primarily a snapdragon issue, whereas the A12 runs on MediaTek, so fingers crossed.
Click to expand...
Click to collapse
If you were able to see the settings are enabled through ADB that is the same as it showing in settings. KG/RMM state could also be the factor of why it isn't beeing shown as of what you have said. Samsung has came a long way with these dumb knox securities which just makes everything worse, you might be able to find a clue for this within their KNOX documents ( I sent a link in a post above). Maybe you can find a profesional, a person that has worked for samsung and can maybe help you with this. It just gets too complicated at one point. If you have telegram or something were we can talk further about this it would be nice because some exploits and stuff if you mention can violate xda rules... So I don't know what else to tell you, I never really was in a situation where I was required to do these type of stuff, only if I had to because of some problems I had. Maybe you can find answers for all of this on some really old forums where people use to do everything to brake apart samsungs and mediateks security locks but still dout it.
For now, hope you learned something and dm me if you want to chat on telegram or etc about this. Don't think something is impossible because you can't find a answer for it, everything is possible.
LAST_krypton said:
If you were able to see the settings are enabled through ADB that is the same as it showing in settings. KG/RMM state could also be the factor of why it isn't beeing shown as of what you have said. Samsung has came a long way with these dumb knox securities which just makes everything worse, you might be able to find a clue for this within their KNOX documents ( I sent a link in a post above). Maybe you can find a profesional, a person that has worked for samsung and can maybe help you with this. It just gets too complicated at one point. If you have telegram or something were we can talk further about this it would be nice because some exploits and stuff if you mention can violate xda rules... So I don't know what else to tell you, I never really was in a situation where I was required to do these type of stuff, only if I had to because of some problems I had. Maybe you can find answers for all of this on some really old forums where people use to do everything to brake apart samsungs and mediateks security locks but still dout it.
For now, hope you learned something and dm me if you want to chat on telegram or etc about this. Don't think something is impossible because you can't find a answer for it, everything is possible.
Click to expand...
Click to collapse
Well after trial and error, I finally got it. I had to hunt down an Android 10 firmware with a matching binary to allow a downgrade, and after a couple of tries, using the auto-date/time method, OEM unlocking finally decided to show itself in dev settings. Specifically, I used this FW, flashed with Odin https://samfw.com/firmware/SM-A125U/USC/A125USQS2AUF3
R0GUEEE said:
Well after trial and error, I finally got it. I had to hunt down an Android 10 firmware with a matching binary to allow a downgrade, and after a couple of tries, using the auto-date/time method, OEM unlocking finally decided to show itself in dev settings. Specifically, I used this FW, flashed with Odin https://samfw.com/firmware/SM-A125U/USC/A125USQS2AUF3
Click to expand...
Click to collapse
Well, you couldev done that allready out of the start. But even do you got OEM_UNLOCKING shown doesn't really mean anything on U model, unless you have exploits and methods for unlocking PBL. Which as said wasn't very sucessful at all for you. I recomend to you that you check our DMs. mtkclient has some bugs which are on the way to be fixed.
I've been working with mtkclient for months, before it even unlocked bootloaders, I was the first to unlock the stylo 6 bootloader and I had a bit of a hand in working out some of the bugs with the tool, I'm doing a full backup of the A125U model right now with mtkclient and after it's done I plan to try the unlock without having oem unlock option in dev options, but first I'll check to see what binary version I'm on, not sure if it's on android 10 or 11 right now. But I will sheet the backup
I finally finished my tutorial for the stylo 6 bootloader unlock and root so now I'm working with the A125U. I'm on 2nd binary and i think i got the bootloader unlocked, but if I flash the patched boot.img it won't boot. I'm gonna try a few ideas i have, so far no luck but I'm not gonna give up, I may crossflash, but I'm trying to find the easiest way to do this.
LAST_krypton said:
@R0GUEEE
Here I will share these links and documents that could help.
[Android][UNSAMLOCK] Bootloader Unlock for Samsung US/Canada Devices
This thread is @svetius approved Important notice: Do not update to April 2023 security update (XXXXXXXXXXWCX) or later. Examples: G998USQS6EWCA, N986USQU4HWD1. Samsung has patched the bootloader unlock again on those updates. NOTE: The OneUI...
forum.xda-developers.com
How to unlock Unisoc (SPD) bootloader using Identifier Token
This tutorial will explain how to unlock a Unisoc / Spreadtrum (SPD) Android device's bootloader using its Identifier Token. This guide is ideal for those who had tried the generic fastboot bootloader
forum.hovatek.com
Where is the "download mode" code stored?
At least Samsung Galaxy series devices support download mode(also known as Odin mode or flash mode) which usually can be accessed by pressing down specific buttons while powering on the phone. Is t...
android.stackexchange.com
How I can downgrade from U3 to U1 "oreo to nougat"
I want to downgrade my phone from Oreo to Nougat My phone is Samsung J730F. But the problem is that Samsung locked the boot-louder. Can I go back by flashing the phone combination ROM then flash my
android.stackexchange.com
http://newandroidbook.com/21-Security.pdf?aboot
Reverse Engineering Android's Aboot
How to use MTK Bypass to backup or flash secure boot MTK
This is a step by step guide showing how to flash or backup a Mediatek (MTK) secure boot device without using a custom download agent (DA). This tool disables the SLA / DAA bootrom protection A little
forum.hovatek.com
How to use an MTK Secure Boot Download Agent (DA) file
This tutorial will explain how to use that DA file you just downloaded for your Mediatek (MTK) device with Secure Boot. You'll need the DA file to backup, flash, bypass Factory Reset Protection (FRP)
forum.hovatek.com
Click to expand...
Click to collapse
GitHub - MTK-bypass/bypass_utility
Contribute to MTK-bypass/bypass_utility development by creating an account on GitHub.
github.com
I'm glad to see Hovatek being suggested, i worked with them on my stylo 6 project, they even gave me a shout out if you look in the mtkclient instruction for the K51.
Here's the scatter file for the A125U model
MT6765_A12_scatter.txt
drive.google.com
LAST_krypton said:
Well, you couldev done that allready out of the start. But even do you got OEM_UNLOCKING shown doesn't really mean anything on U model, unless you have exploits and methods for unlocking PBL. Which as said wasn't very sucessful at all for you. I recomend to you that you check our DMs. mtkclient has some bugs which are on the way to be fixed.
Click to expand...
Click to collapse
R0GUEEE said:
Well after trial and error, I finally got it. I had to hunt down an Android 10 firmware with a matching binary to allow a downgrade, and after a couple of tries, using the auto-date/time method, OEM unlocking finally decided to show itself in dev settings. Specifically, I used this FW, flashed with Odin https://samfw.com/firmware/SM-A125U/USC/A125USQS2AUF3
Click to expand...
Click to collapse
I own a a125u with FW A125USQU2BUI3. Would I be able to use this method to make oem unlock appear and then root? If so could you please assist me and help with the steps? I've been attempting to root this thing for a week and my girl friend is starting to hate me because I'm obsessed and paymore attention to this than her lol
I see that I can add user-settable root of trust to the bootloader so I can set custom secure boot keys like PCs at https://source.android.com/docs/security/features/verifiedboot/device-state , so I think I can use a user modified init_boot image (including the magisk patched one) by signing it with my own keypair.
Also, I know that some manufacturers require 7 days for new devices to be unlocked (like Xiaomi) or do not allow user unlock at all. However, authorized repairers can flash signed factory system images without unlocking it. I guess it is implemented by internal (read-only) root of trust. But can I do this with user-settable root of trust part so I can become authorized repairer to my own device?
P.S. I am using a bootloader-unlocked Pixel 4 XL as my major phone now. I have bought a Pixel 7 Pro but not yet switched to it. I am looking for a method to take both security and scalability into account.
Good and interesting question, sadly I don't have a definitive answer to it - but a few thoughts:
As to your own keypair: I would think that the bootloader checks for integrity and you would need to patch bootloader as well to accept a user-key - not sure if this is feasible.....
AFAIK for Xiaomi devices the authorized repairers use EDL mode with a separate authentification - EDL-mode is (IMO) a separate very low-level boot mode.... I don't think this is related to the "normal" boot mechanism and its keys.....
Is there any specific reason you are aiming for a re-locked bootloader ? The only aspect I could think about is some specific apps that can detect an unlocked bootloader and refuse to function.... from a pure security standpoint I don't see a benefit from re-locking a modified device, at least until you really (!) know all modifications that have been done in low-level detail.....
s3axel said:
Good and interesting question, sadly I don't have a definitive answer to it - but a few thoughts:
As to your own keypair: I would think that the bootloader checks for integrity and you would need to patch bootloader as well to accept a user-key - not sure if this is feasible.....
AFAIK for Xiaomi devices the authorized repairers use EDL mode with a separate authentification - EDL-mode is (IMO) a separate very low-level boot mode.... I don't think this is related to the "normal" boot mechanism and its keys.....
Is there any specific reason you are aiming for a re-locked bootloader ? The only aspect I could think about is some specific apps that can detect an unlocked bootloader and refuse to function.... from a pure security standpoint I don't see a benefit from re-locking a modified device, at least until you really (!) know all modifications that have been done in low-level detail.....
Click to expand...
Click to collapse
The reason why I am aiming for a re-locked bootloader is that everyone can flash a modified image at bootloader. An evil maid or cop may be able to flash a trojan boot image when I am not with my phone.