DELETED

[brokenworm]

DELETED

 

[brokenworm]

reserved...

 

[c_86]

What's the purpose of this?

 

[AJsama]

...well , anyone tell me what is this ?

 

[brokenworm]

...well , anyone tell me what is this ?

its a modifyed XBL bootloader... for now the security hole is enabled if you know what to do with the partition sde34 ...
ill build a image for the partition that wil make the secureboot frack up .. sp we can get rid of the stupid text on unlocked oem

it is not gonna happend in 1 day ... let me and others work on it
its a good start , and i DID try the files on my own ot5 before publishing it

 

[Mervingio]

In

Sent from my ONEPLUS A5010 using Tapatalk

 

[tids2k]

Wow @brokenworm this is amazing ! thanks. have you only tried this on oneplus bootloaders. I am sure thus could be worked up on other devices too. You should msg alephsecurity and tell them about this exploit so that they can furthur explore this. Thanks again

 

[EugenStanis]

So, I just have to flash it and "bootloader unlocked" message at boot will gone? @brokenworm

EDIT: Nevermind

 

[ussl]

Just wanna make sure, is there a way to revert to the stock BL if I want to relock or something? (Just not sure whether or not OP have released a BL image or something like that)

 

[brokenworm]

So, I just have to flash it and "bootloader unlocked" message at boot will gone? @brokenworm

EDIT: Nevermind

working on that...

 

[AJsama]

its a modifyed XBL bootloader... for now the security hole is enabled if you know what to do with the partition sde34 ...
ill build a image for the partition that wil make the secureboot frack up .. sp we can get rid of the stupid text on unlocked oem

it is not gonna happend in 1 day ... let me and others work on it
its a good start , and i DID try the files on my own ot5 before publishing it

wow , coolll!:victory:

 

[pillowsnyc]

Am I the only one that looked at the title and wondered what Xbox Live had to do with OnePlus

On topic: I look forward to Future releases based on this and other creative things can be done

 

[evil_pro]

Did somebody flash this and did it work?

 

[Shad0wKn1ght93]

If this actually works, that'd mean that OnePlus somehow managed to knock out the signature verification of the bootloader. If you flash this on a properly provisioned retail device, you're just gonna brick it. You can't just modify random stuff in signed firmware images and expect them to work on retail hardware.

 

[brokenworm]

If this actually works, that'd mean that OnePlus somehow managed to knock out the signature verification of the bootloader. If you flash this on a properly provisioned retail device, you're just gonna brick it. You can't just modify random stuff in signed firmware images and expect them to work on retail hardware.

im ofcource rooted with magisk and have twrp installed

PBL comes before XBL "PBL the primary bootloader"

so u dont have to worry... and i WILL NOT publish anything before i have flashed it on my own phone first ...

currently iv managed to tick the 0x01 to 0x0 to make the security hole active.. default was 0x01

... SPLASH partition sde34 is currently NOT checked by either xbl or pbl even if u edited the partition sde34 and restored all to stock "also my XBL" it would start as normal .. niether red warning or orange ! i testet this !
i managed to edit the check meaning its disabled on that partition with a simple 0x0 and removed # to get it to respond to the ticks ! but surely u cannot run my XBL completly stock ONLY sde34 , its just not what we are doing here
we try to get the securityhole on sde34 to smash up the secboot ... sde34 is the way .. not my xbl , the xbl was to remove the rsa hashing / checks on the partition nothing else. so while we work on the explorit we use the xbl.. but im hoping someone takes it further and DOES make the xbl to do so carnage without the sde34

dont come tell me what i can and can not do.. were doing it anyways !

 

[tfwboredom]

im ofcource rooted with magisk and have twrp installed

PBL comes before XBL "PBL the primary bootloader"

so u dont have to worry... and i WILL NOT publish anything before i have flashed it on my own phone first ...

currently iv managed to tick the 0x01 to 0x0 to make the security hole active.. default was 0x01

... SPLASH partition sde34 is currently NOT checked by either xbl or pbl even if u edited the partition sde34 and restored all to stock "also my XBL" it would start as normal .. niether red warning or orange ! i testet this !
i managed to edit the check meaning its disabled on that partition with a simple 0x0 and removed # to get it to respond to the ticks ! but surely u cannot run my XBL completly stock ONLY sde34 , its just not what we are doing here
we try to get the securityhole on sde34 to smash up the secboot ... sde34 is the way .. not my xbl , the xbl was to remove the rsa hashing / checks on the partition nothing else. so while we work on the explorit we use the xbl.. but im hoping someone takes it further and DOES make the xbl to do so carnage without the sde34

dont come tell me what i can and can not do.. were doing it anyways !

Editing a text config file in this case is as much of a change as if I told you that I am using a OnePlus 7 just because I changed my build.prop to say that. Without compiling the bootloader with these changes in effect, it really isn't making a difference. Additionally as the person above me pointed out, if you were able to run a modified XBL I'd be very surprised. Did you actually try this?

 

[Shad0wKn1ght93]

im ofcource rooted with magisk and have twrp installed

PBL comes before XBL "PBL the primary bootloader"

so u dont have to worry... and i WILL NOT publish anything before i have flashed it on my own phone first ...

currently iv managed to tick the 0x01 to 0x0 to make the security hole active.. default was 0x01

... SPLASH partition sde34 is currently NOT checked by either xbl or pbl even if u edited the partition sde34 and restored all to stock "also my XBL" it would start as normal .. niether red warning or orange ! i testet this !
i managed to edit the check meaning its disabled on that partition with a simple 0x0 and removed # to get it to respond to the ticks ! but surely u cannot run my XBL completly stock ONLY sde34 , its just not what we are doing here
we try to get the securityhole on sde34 to smash up the secboot ... sde34 is the way .. not my xbl , the xbl was to remove the rsa hashing / checks on the partition nothing else. so while we work on the explorit we use the xbl.. but im hoping someone takes it further and DOES make the xbl to do so carnage without the sde34

dont come tell me what i can and can not do.. were doing it anyways !

You didn't "trick" anything. You used HexEdit to edit two bytes. In doing so you've invalidated the signature, and actually messed up the image itself, since you can't just randomly insert bytes into it. Proof is in the attachment. No way in hell this boots.

First attachment shows the terrible editing (removed the #, which breaks the parsing / added a byte later on that corrupts the entire image from thereon), second one the resulting corruption of the image as a result of the extra byte that he added.

 

[Macusercom]

You didn't "trick" anything. You used HexEdit to edit two bytes. In doing so you've invalidated the signature, and actually messed up the image itself, since you can't just randomly insert bytes into it. Proof is in the attachment. No way in hell this boots.

First attachment shows the terrible editing (removed the #, which breaks the parsing / added a byte later on that corrupts the entire image from thereon), second one the resulting corruption of the image as a result of the extra byte that he added.

Thanks for pointing that out! Seriously, why upload a dangerous ZIP file that could probably corrupt one person's bootloader. I myself have very little knowledge on how bootloaders work but the thing that I do know is that they are not easily editable without breaking tons of security mechanisms. Such easy edits would be the easiest way to go for hackers if it were true.

 

[CZ Eddie]

No reason to be rude in this thread.
Just because you may know something he doesn't, does not give you the right to be so rude.

But I appreciate the OP trying.
It's more than I'm capable of doing.

And I do appreciate your input on why you believe you know it won't work.

 

[the Doctor]

THREAD CLEANED

Expressing differences of opinion on XDA is fine, even expected. Doing so with a rude, condescending tone and flaming others is not. Per the forum rules:

2.3 Flaming / Lack of respect: XDA is about sharing and this does not involve virtual yelling (flaming) or rudeness. Flaming or posting with a lack of respect is unacceptable. Treat new members in the manner in which you would like to have been treated when you were a new member. When dealing with any member, provide them with guidance, advice and instructions when you can, showing them respect and courtesy. Never post in a demanding, argumentative, disrespectful or self-righteous manner.

2.4 Personal attacks, racial, political and / or religious discussions: XDA is a discussion forum about certain mobile phones. Mobile phones are not racial, political, religious or personally offensive and therefore, none of these types of discussions are permitted on XDA.