General EDL Flash Tool Leak
- Thread starter OppoTech123
- Start date
It's only for this user so can't be used outside of their system.. Once he closes it is gone
Able to flash? If u not have device then share this moded tool I'll chk i have device
The only thing we can take is a complete USB dump. To better understand the protocol, handshakes and communication to and from the device.
The MSMTool is so locked down, like it effing binds itself to your network card's MAC Address
That's ridiculous man.... bizarrely overly protected.The only thing we can take is a complete USB dump. To better understand the protocol, handshakes and communication to and from the device.
The MSMTool is so locked down, like it effing binds itself to your network card's MAC Address
Can u guide how can we get china service support is there any live chat support i also have device to flash
Call 400 888 1111, find the manual service, and tell him your device needs to flash
I almost figured out what is sent to the server during flashing. The flash tool sends "chip ID", "account token", and "Epoch timestamp" to server API which is server-domain/API/sign/ to query a signature for firehose and encrypt the query parameters with a public key. This info can be found in MSM download tool 2.0.6.9.
If anyone want to see it yourself, simply get a debugger, such as, x64dbg with ScyllaHide plugin enabled, follow the assembly instructions to get to the OEP then dump PE from memory and fix import table to unpack it from VmProtect3.x. After unpacking the file, use a decompiler to run a PE static analysis, IDA Pro or Ghidra can both do it, search for "/API/sign/" from defined strings, from that you can locate the auth function for VIP signature. In that function, you can find a public key used to encrypt the queries, and also two variables, one is "account token", the other one is "Chip ID". Chip ID is unique for every device, which may be a issue.
I haven't done a full analysis with the tool, not being sure if there's a timestamp protection on it. But I still strongly suggest who is able to flash with auth remember to capture the signature for your device, so you might not need a auth in future because your Chip ID is always yours.
If anyone want to see it yourself, simply get a debugger, such as, x64dbg with ScyllaHide plugin enabled, follow the assembly instructions to get to the OEP then dump PE from memory and fix import table to unpack it from VmProtect3.x. After unpacking the file, use a decompiler to run a PE static analysis, IDA Pro or Ghidra can both do it, search for "/API/sign/" from defined strings, from that you can locate the auth function for VIP signature. In that function, you can find a public key used to encrypt the queries, and also two variables, one is "account token", the other one is "Chip ID". Chip ID is unique for every device, which may be a issue.
I haven't done a full analysis with the tool, not being sure if there's a timestamp protection on it. But I still strongly suggest who is able to flash with auth remember to capture the signature for your device, so you might not need a auth in future because your Chip ID is always yours.
Call 400 888 1111, find the manual service, and tell him your device needs to flash
Do they speak English...?
Do they speak English...?
Last edited by a moderator:
From different country its looks impossible to call
They even not support different country
So live chat or email will be much appreciated
- May 27, 2010
- 4,088
- 5,276
Hi linjinxuan,
As a member, you know that you must use the English language in your posts, as per forum rule #4, because you must have read the rules before posting.
As a "unique" courtesy, I have translated your post in this thread and because it was not spam.
Please be respectful and observe XDA rule #4 for all future posts.
Next time your post will be deleted
Regards
Sib64
Moderator
Translation:
As a member, you know that you must use the English language in your posts, as per forum rule #4, because you must have read the rules before posting.
Please be respectful and observe XDA rule #4 for all future posts.
Next time your post will be deleted
Regards
Sib64
Moderator
Translation:
Last edited:
You're able to get an OPPO account?
Brush is simply a different word for flash over there
A guy that flashed remotely for me had to setup a specific mac address on my network adapter to work.The only thing we can take is a complete USB dump. To better understand the protocol, handshakes and communication to and from the device.
The MSMTool is so locked down, like it effing binds itself to your network card's MAC Address
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
2Man honestly I don't have any truly awesome suggestions... Currently with the state of things , safety of your devices is priority 1. Because as you said, 1 misstep can take you from functional to disabled and needing repair! Then there is no "free" ... I'm happy you rescued your device.
One thing is I heard about something called a "deep sleep cable" ... Another member brought his phone back from the dead, AND said through the cable and something called QuadComs... He unbricked his phone with no MSM tool. And his phone was DEAD ... UNRESPONSIVE.
Obviously I need more data before I can make specific claims, but he is reliable so I tend to believe it was as good/easy as he made it sound!1
Yes... I believe.. as long as the device has a Qualcomm chipset, then yes, that's what EDL is built for.... If it's a MTK device, you would use SpFlash tool...1so
sounds promising hopefully its legit and would get out to the public
btw whats your phone i found out that you're trying to root it?
also you might be interested in patching firehose files that alone would solve everything -
16Hello all, i am here to leak OPPO tech tool that allows one plus 10 pro to be flashed. Sadly i cannot share login but if you are able to bypass login screen the tool does not need to authenticate with server to flash device in EDL mode. Attached is screen shot of login screen and file. The tool picks up device in EDL mode and allows user to select the OPF file associated for device (please note you must have this downloaded externally ideally from msm tool for your device)
I wish you luck bypassing this login and fixing your phones.
15
Ok .. just putting this out there... I MAY have pulled together a script that will automate the whole flash process .. including the auth, and sign verifications... But I truly do not know if it is going to be device specific, or if I can fandangle a slightly wider base from the data. Now 1st. Don't start asking me to drop the code into public chat. I worked my butt off and bricked my own devices SEVERAL times in order to test/work out the kinks ... (Proxifier/Fiddler were not friendly and butted heads a lot, so alternate avenues were taken) but before I could compile the whole script and run in one sweep, the Oppo account I was using expired. (Temp accounts ARE device specific). If you want ANY further development on this, I NEED someone to DM me, an active Oppo acct. I don't care if you want to change the password , 24hrs after you give me the info .. that's completely fine. If everything works properly, 24 hrs is about 23 hrs too much! But I need an ACTIVE , WORKING account that I can login to the msmtool, or the miflash server with, (preferred MSM so I don't gotta rewrite anything). And if I can perform a successful EDL unbrick without any errors, then I can strip parts of the Online MSM tool.exe , and with luck, force the Frankenstein'd version I pieced together, to package back up into a simple "Click, Select, Start, Wait, Celebrate" , exe file. With everything that you need, all put into portable container mode, and require no installation. (Or at bare minimum you can run it all inside a windows sandbox, cuz that's what I've been doing, so there's 0 chance of any persistent tracker left behind after each flash, and at the same time you can feel safe running it, cuz in a sandbox it cant harm you !).
So again... If anyone still cares, and has any resources to obtain a login/pw that works, DM me , and WAIT FOR ME TO REPLY before you send the login, so you know exactly WHEN I got it, and you can change whatever .... Let's say .... 6-12 hrs after you grant me access!
Otherwise it seems like this topic has died and no one cares anymore... Which rly don't bother me, cuz after this bunch of Diseased Unicorn Poo
that Oppo/OnePlus pulled with literally going from "Developer Friendly" to "We'll eat your soul before we allow consumer modifications !" 
I am officially done with this company, and I truly hope a good 20% of their customer base feels the same, because the only way they will reverse their ignorant position , rivaling Apple IOS level lunacy, is if their yearly bonus checks are a few zeros short, and sales drop. (Shouldn't be a problem because T-Mobile just loosened the reigns and allowed Verizon to begin pre ordering the 10R for next year... So NA will at least have 2 major carriers .... But I don't think it will help sales ... Verizon is the Hitler Regime of Bootloader and device unlocking... They might go as far as to request an official Red/Black design with little bands around the top! Lol.
Anyways ... Login/pw ... Oppo account... DM....
Let's see if I can rain on the MSMTool Mafia's day just a lil bit. This tool should be provided FREE ... We're at over 1 year since released, and NO PUBLIC MASS CONSUMER UNBRICK , yet they throw the FW around on the main website, with official tags and signatures .... And even then .. one wrong action, and youre doin the "1-Ploo-Salloop!" (Infinite boot loop!) ... So if you can brick, using the files THEY provide, without knowing your current device setup!, They need to provide a method out! (And yes this can happen, because if you had previously done ANY modifications, such as rooting, forgetting to unhide magisk app, disable modules, or making any alterations to your initrc file , or had successfully swapped regions, then tried to flash the STOCK rollback, in order to bring your device back to factory spec, YOU WILL BOOTLOOP!)
((I have further details regarding what is one factor causing this to happen... It's the Baseband/Modem/Build.prop versioning that is putting your device out of spec. Each different Rollback/Upgrade package specifies an EXACT build # and patch date that each region has a slightly different variation of, and while you THINK you're fooling your device, You are ABSOLUTELY NOT! Part of the downloaded FW verification that happens before your phone reboots to complete the changes, is a quick matchup of some key files which your phone FAILS to notify you, when they do not match the requested info... And therefore those files are NOT replaced by your phone during the update/rollback.... So for anyone who knows Android.... This is a very big NO NO... you cannot update parts of a boot script... Parts of the system ... Parts of the recovery partition, but not also make the Android security patch, Kernel, modem, and other pertinent variables match their new counterparts. WHY? Can you use Android 13's Kernel, to run Android 12's security requirements, load 12's lower boot.img, but keep 13's modem, and flip a coin as to which recovery part will stay, then smash that all together under a security patch that is lower than your device was on! This is exactly what creates the "unresponsive device" brick. Cuz NOTHING is the right version necessary for secure boot and trust zone to approve/verify each other. Aka BRICK.
Ok rant over....
login/pw active Oppo acct.. DM..
Ty15This tool seems to be intended for use with mediatek devices.
I wouldn't bet on it working with this phone, but here's how to bypass the login screen anyway.
Open DownloadTool.exe with a hex editor
Find '74 4b 8d 45 d4'
Replace '74 4b' with '90 90'
Save, launch, enter any username/password/code and click login.
If you go to 'Software Package Management', you can specify a folder where your .ofp is located.8
yoo guys shout out to this man for helping me unbricking me my phone. 5 months no reply for oneplus, he just solved it in one night only! thanks alot bro.
@xuanhoang1811
