- Mar 28, 2021
Sorry I've been kind of quiet around here but I'm still at it....trying various things and also working with a few guys. But....i have reached a little bit of progress but on a different scale. As you know...magisk patches init_boot.....and you can only flash with an unlocked bootloader.....but there's one option that doesn't require it.....OTA (sideload OTA)....so far...I've been able to unpack alot of the firmware and even have a patched init_boot inside the payload folder.....if I can find a way to correctly repack that payload folder into payload.bin....then altogether repack and get an update.zip....then I can try to see if it would work....sounds kind of far fetched but I'm trying to stay positive. I feel close in a way but still far....I'll keep pushing until a solution is solved by me or someone else. It's only a matter of time before this cracks or DirtyCred Android PoC comes out and hopefully covers this kernel...and here we go....at least root....then the real fun can start trying to reverse the packages and crack the two java packages that are responsible for maintaining that OEM toggle off. Another thing.....i know talking about certain apps....are against the rules but LuckyPatcher. Does anyone here have an idea of who makes it or develops it. Reason Im asking is because LP patches Play Services...well on VZW Pixel 7 Pro...the only package that has OEM perms to manage or set OEM is "com.google.android.gms"....that's another road i would like to drive down and see how maybe patching Play services and/or modifying Play services to a vulnerable state where a shell user can ultimately use "run-as" or maybe change context to one of play services.....just a few things I'm working on right now. As well as this S22 Ultra US Version. Big things coming soon. No root yet but at least I can say...I can modify things inside /data/system....like make an app a system-trusted app and it persist. Stay tuned folks. I'm still working....@wr3cckl3ss1 is working very hard on it...
I'm unsure how far he's gotten, although I have high major doubts it will ever be achievable...
but he acknowledges how seemingly impossible it is and is still willing to keep going at it...
you can see a bit of how he's progressing HERE and HERE