Is it bricked? Cannot flash stock Android to remove ArcaneOS

Search This thread

xmoo

Retired Recognized Developer
Aug 19, 2006
5,450
1,803
34
Eindhoven
www.Mohammad.Moghtader.net
Most adb and fastboot commands are marked as unknown. Fastboot is easily accessible. Adb is accessible through Rescue mode.

Graphene webinstaller also did not work.
 
Last edited:
Oct 5, 2022
14
1
any way of entering it, doesn't matter. at least on mtk, you can use mtkclient to backup, im still trying to find a firehorse for you. sprd requires a manifest to backup but on qcom i dont know
you can try these files here if you would like, it is from a different device, but same soc, gpu, and cpu as sunfish pixel 4a. i removed the img files as they were large. it comes from https://droidfilehost.com/download/realme-x2-rmx1992-firmware-flash-file-stock-rom/ and was decrypted
 

Attachments

  • ofp.504306RMX1992_11_F.26_2021122215313722.zip.RMX1992_11_F.26_2021122215313722.zip
    68.8 MB · Views: 20
Oct 5, 2022
14
1
Short is not an option. Don't want to brick the device. Took a while to find one.
I tried the ADB and Fastboot way, no success. I tried the key-shortcut wat, no success.
Key-shortcut wat? What's that, you mean holding down Vol - and pluging in the usb when turned off? And why is short not an option, you should be able to exit it anyways. And what about those usb things online where you plug in something and it works (altho idk about it or if its a scam or not)
 

xmoo

Retired Recognized Developer
Aug 19, 2006
5,450
1,803
34
Eindhoven
www.Mohammad.Moghtader.net
Key-shortcut wat? What's that, you mean holding down Vol - and pluging in the usb when turned off? And why is short not an option, you should be able to exit it anyways. And what about those usb things online where you plug in something and it works (altho idk about it or if its a scam or not)
With "you might need to short something" you are reffering to circuit board right?

Key-shortcut I am indeed reffering to key combination to get the phone into EDL mode.

"And what about those usb things online where you plug in something and it works (altho idk about it or if its a scam or not)" I have no idea what you are reffering to. Any video or link?
 
Oct 5, 2022
14
1
With "you might need to short something" you are reffering to circuit board right?

Key-shortcut I am indeed reffering to key combination to get the phone into EDL mode.

"And what about those usb things online where you plug in something and it works (altho idk about it or if its a scam or not)" I have no idea what you are reffering to. Any video or link?
1. Yes
2. So it doesn't work, I thought so because Pixel's are the hardest to get to EDL unless you flash the wrong FW, which you cant even flash anything. Even Stock Pixel is hard on EDL, Google relies too much on 2nd stage Fastboot which isn't a good if they auto update that.
3. I'm talking about this https://www.ebay.com/itm/322476443357
 
Oct 5, 2022
14
1
1. Yes
2. So it doesn't work, I thought so because Pixel's are the hardest to get to EDL unless you flash the wrong FW, which you cant even flash anything. Even Stock Pixel is hard on EDL, Google relies too much on 2nd stage Fastboot which isn't a good if they auto update that.
3. I'm talking about this https://www.ebay.com/itm/322476443357
Update: Don't use the ZIP I uploaded earlier, I am trying to dump it from the bootloader img file right now, which half of prog_firehose_ddr.elf is actually in the bootloader (bootloader-sunfish-s5-0.2-6281315.img)
 
  • Like
Reactions: xmoo
Oct 5, 2022
14
1
Update: Don't use the ZIP I uploaded earlier, I am trying to dump it from the bootloader img file right now, which half of prog_firehose_ddr.elf is actually in the bootloader (bootloader-sunfish-s5-0.2-6281315.img)
Try 000e60e10066000a_3ef72a02fb931be1_fhprg.bin I even searched the name up and found 1 result of someone looking for the same file name I generated (hopefully its valid tho)
 

Attachments

  • ..log
    1.3 KB · Views: 21
  • 000e60e10066000a_3ef72a02fb931be1_fhprg.bin
    3.2 MB · Views: 27
  • imjtool.tgz
    586.5 KB · Views: 13
  • bootloader-sunfish-s5-0.2-6281315.img
    8.1 MB · Views: 22
Oct 5, 2022
14
1
No, over EDL, if you can get there, using this tool is recommeded if you can handle the command line http://github.com/CE1CECL/edl and doing a complete backup of flash, not just partitions.
If you are using windows use this template if you dont know how to use it (I cant figure out how to embed text so it will be like this for now until i figure it out later)

Command to Run:

git clone https://github.com/CE1CECL/edl
cd edl
git submodule update --init --recursive
pip3 install -r requirements.txt

----------------------

Copy 000e60e10066000a_3ef72a02fb931be1_fhprg.bin to the EDL folder where you cloned it to and then run something like this

python .\edl.py rf arcaneos.bak --loader=000e60e10066000a_3ef72a02fb931be1_fhprg.bin

Just make sure you have python 3.9, git and usbdk from the README of the repo.
If its too large let me know if you need something to upload it with (if you get what i mean), Once i get it i will compress it later.
 
Oct 5, 2022
14
1
If you are using windows use this template if you dont know how to use it (I cant figure out how to embed text so it will be like this for now until i figure it out later)

Command to Run:

git clone https://github.com/CE1CECL/edl
cd edl
git submodule update --init --recursive
pip3 install -r requirements.txt

----------------------

Copy 000e60e10066000a_3ef72a02fb931be1_fhprg.bin to the EDL folder where you cloned it to and then run something like this

python .\edl.py rf arcaneos.bak --loader=000e60e10066000a_3ef72a02fb931be1_fhprg.bin

Just make sure you have python 3.9, git and usbdk from the README of the repo.
If its too large let me know if you need something to upload it with (if you get what i mean), Once i get it i will compress it later.
if you can can you debug where the network for the update api is sending to? Maybe i can debug that while i wait finding a device on ebay, since i cant find anything.
 

H4xz0r

New member
Nov 4, 2022
2
0
I don't know but have been told that LineageOS has been installed on the device, see below for the image version.
 

Attachments

  • Screenshot 2022-08-24 at 14.10.41.png
    Screenshot 2022-08-24 at 14.10.41.png
    4.2 MB · Views: 127

Top Liked Posts

  • There are no posts matching your filters.
  • 7
    Ok... sorry for the delay. Yes, I can confirm the speculation going around... I accidentally bought an AN0M phone. And yes, I was fortunate enough to sell it again (and got most of my money back)... to a reporter at vice.com. And, BTW, I have bought myself another Pixel 4a... this time it is working properly.

    Some background points before I finally figured out exactly what I had in my possession...
    - Being unable to unlock/reset this phone, I started looking at my firewall logs to see what activity this phone was generating. I noticed the following:
    - regular HTTPS requests to arcane.one. I couldn't find anything useful on or about that site.
    - occasional HTTPS requests to time.grapheneos.org. This leads me to believe that ArcaneOS might be forked from GrapheneOS.
    - intermittent HTTPS requests to anom.one. I couldn't find anything useful on or about that site, however the word anom led me to discover the joint FBI/AFP operation that had just hit the news a few days earlier.
    - Now suspecting I had an An0m phone, I checked the calculator app... and yes, it loaded straight into the AN0M logon screen.
    - At this point, I panicked and thought I could get into trouble if this device was being tracked... so I rang the police and described my situation. They said to take it to my local police station. I call my local station (being in a small rural town, it is usually unmanned) and was advised to contact the AFP (Australia Federal Police), since it was their operation to begin with.
    - I called the AFP, explained again what had happened. The nice lady I spoke to confirmed that their activity with Operation Ironside had just finished and that, yes, they had supplied such phones to some of their informants. I left them my contact details and the details of the Gumtree seller who I purchased this phone from. I was hoping that maybe he would be a person of interest to the AFP, and that I would get some measure of payback for him scamming me in the first place.
    - I waited a week, the AFP did not call back... so I sold the phone to vice.com, who had already contacted me about this thread.
    - It occurs to me now why "ArcaneOS" was practically unheard of in the googleverse (until a few weeks ago). This was a state sponsored development and, of course, it was in the best interest of law enforcement authorities to keep the normally open-source Android code hidden to prevent this phone being tinkered with and the true purpose of this OS and app being discovered.

    To everyone that helped and suggested ideas to restore this phone to normal... thankyou. Although nothing we tried worked in the end, I still appreciate the community assistance here.

    To everyone that has contacted me directly to ask how to fix their Pixel phone... sorry, I cannot help you.

    I suspect it would still be possible to restore this phone... you'd just need to know the right commands to do it. By that I mean, I assume the developers probably changed the normal fastboot commands to some other arbitrary words; something that would allow them to test, develop and repeatedly re-flash their phones, yet prevent us from doing likewise.

    EDIT: I've added a photo of the AN0M logon screen. I did not see this originally and the calculator app was not available when I took my original set of photos... at that time I had recently done a factory reset on the phone. However, after some time a message popped up saying that Calculator was "Updated by your admin"... which seemed strange to me at the time, as this was not supposed to be a managed device.
    4
    I recently purchased a used Pixel 4a, and I now understand why the seller was offering such good price for it and why he refused to respond to me now I have it. This phone has ArcanseOS 10 installed, which has only 3 apps installed... Setting, Clock and Calculator. There is no Play Store app, no Phone app, nothing.

    The only useful reference to ArcaneOS I can find in the Googleverse is this one... https://translate.google.com.au/tra...rueck-flashen.973774.html&prev=search&pto=aue where the OP describes his troubles with a Pixel 3. Through the rough translation, I see similar issues... can't enable developer mode, can't unlock bootloader, can't sideload apps.

    Some random observations about this phone/OS...
    - The phone is in good condition. I used the supplied pin code to unlock it and did a factory reset. Have done basic config with my Google Account, etc.
    - In Settings > About Phone - the build number is not shown. I cannot tap on the build number 7 times to enable Developer Mode. I have tried tapping everything in About Phone 7+ times, but I have not been able to enable Developer Mode.
    - When the phone powers on, the first thing shown is a message like "Your device is loading a differennt operating system".
    - The installed OS is ArcaneOS 10. The system updater says that ArcaneOS 11 is available for download (but I don't want to do that in case it makes this thing even harder to fix).
    - I tried sideloading open_gapps and a random developer shortcut app I found, but I can't seem to get them to load.

    I'm no expert at this, so I've tried various commands that I found and got some of these results...
    (note: some details, esp path names, have been edit for brevity)

    >adb devices List of devices attached 09241JEC228869 sideload >adb shell error: closed >adb sideload open_gapps-arm64-10.0-stock-20210518.zip adb: sideload connection failed: no devices/emulators found adb: trying pre-KitKat sideload method... adb: pre-KitKat sideload connection failed: no devices/emulators found >adb sideload "by4a.setedit22_2018.10.31-18_minAPI11(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk" serving: 'by4a.setedit22_2018.10.31-18_minAPI11(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk' (~47%) adb: failed to read command: No error >adb shell settings put global development_settings_enabled 1 error: closed >adb root adb: unable to connect for root: closed >adb shell error: closed

    >fastboot --version fastboot version 31.0.2-7242960 >fastboot devices 09241JEC228869 fastboot >fastboot flash bootloader sunfish-rq2a.210505.002\bootloader-sunfish-s5-0.3-7062598.img Sending 'bootloader' (8357 KB) FAILED (remote: 'Download is not allowed on locked devices') fastboot: error: Command failed >fastboot flashing unlock FAILED (remote: 'Unrecognized command flashing unlock') fastboot: error: Command failed

    Any suggestions on how to unlock this device? Then I can flash it and restore it back to stock.

    Thanks

    PS. Please do not say "tap build number 7 times to enable Developer Mode/options". If you believe this is the solution, please re-read this post, and the linked/German post, then describe a different way of doing that task that doesn't rely on the build number being visible.
    4
    Thankyou for everyone's help with the unusual phone. I am no longer in possession of it and, for the time being, am unable to provide further details. I do have an interesting update to share, however I have made a commitment to keep this quiet for the time being. Once I have approval to tell you what I have recently learnt, I will...
    4
    If anyone else gets a phone running ArcaneOS, send me a message :)

    Also, you're famous, OP: https://www.vice.com/en/article/n7b4gg/anom-phone-arcaneos-fbi-backdoor

    2
    I recently purchased a used Pixel 4a, and I now understand why the seller was offering such good price for it and why he refused to respond to me now I have it. This phone has ArcanseOS 10 installed, which has only 3 apps installed... Setting, Clock and Calculator. There is no Play Store app, no Phone app, nothing.

    The only useful reference to ArcaneOS I can find in the Googleverse is this one... https://translate.google.com.au/tra...rueck-flashen.973774.html&prev=search&pto=aue where the OP describes his troubles with a Pixel 3. Through the rough translation, I see similar issues... can't enable developer mode, can't unlock bootloader, can't sideload apps.

    Some random observations about this phone/OS...
    - The phone is in good condition. I used the supplied pin code to unlock it and did a factory reset. Have done basic config with my Google Account, etc.
    - In Settings > About Phone - the build number is not shown. I cannot tap on the build number 7 times to enable Developer Mode. I have tried tapping everything in About Phone 7+ times, but I have not been able to enable Developer Mode.
    - When the phone powers on, the first thing shown is a message like "Your device is loading a differennt operating system".
    - The installed OS is ArcaneOS 10. The system updater says that ArcaneOS 11 is available for download (but I don't want to do that in case it makes this thing even harder to fix).
    - I tried sideloading open_gapps and a random developer shortcut app I found, but I can't seem to get them to load.

    I'm no expert at this, so I've tried various commands that I found and got some of these results...
    (note: some details, esp path names, have been edit for brevity)

    >adb devices List of devices attached 09241JEC228869 sideload >adb shell error: closed >adb sideload open_gapps-arm64-10.0-stock-20210518.zip adb: sideload connection failed: no devices/emulators found adb: trying pre-KitKat sideload method... adb: pre-KitKat sideload connection failed: no devices/emulators found >adb sideload "by4a.setedit22_2018.10.31-18_minAPI11(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk" serving: 'by4a.setedit22_2018.10.31-18_minAPI11(arm64-v8a,armeabi-v7a,x86,x86_64)(nodpi)_apkmirror.com.apk' (~47%) adb: failed to read command: No error >adb shell settings put global development_settings_enabled 1 error: closed >adb root adb: unable to connect for root: closed >adb shell error: closed

    >fastboot --version fastboot version 31.0.2-7242960 >fastboot devices 09241JEC228869 fastboot >fastboot flash bootloader sunfish-rq2a.210505.002\bootloader-sunfish-s5-0.3-7062598.img Sending 'bootloader' (8357 KB) FAILED (remote: 'Download is not allowed on locked devices') fastboot: error: Command failed >fastboot flashing unlock FAILED (remote: 'Unrecognized command flashing unlock') fastboot: error: Command failed

    Any suggestions on how to unlock this device? Then I can flash it and restore it back to stock.

    Thanks

    PS. Please do not say "tap build number 7 times to enable Developer Mode/options". If you believe this is the solution, please re-read this post, and the linked/German post, then describe a different way of doing that task that doesn't rely on the build number being visible.
    I got mine working.

    You'll need to use the GrapheneOS Web Installer to fix it up.


    Get your device into fastboot/bootloader mode, and use the unlock bootloader option.
    Then run through the rest of the installation steps up until the relock bootloader option. Don't relock the bootloader.

    Then boot into the OS.

    Once I did this, I was then able to boot back to bootloader and flash the factory image.

    Device works just fine now.