General MSM TOOLS

Search This thread
By:
Advanced…
T

tap77

Member
May 12, 2012
19
9
Oslo
Hi,

Since i got my oneplus 10 pro, i have as many others been searching for a MSM tool for our device, but has been unable to locate one. The best and closest thing i found was a site that apparently had MSM tool for every region, but the rar file needed a password to extract so it was of no use. Until today. I checked the same site and for some reason the password was now shown on the site, so i downladed NE2213GDPR_11_A.10_2022022602530000 and it worked!

All files are present but the MSM tool need login though, but maybe we can find a way to get around this?

The OFP file is present and my understanding is that this is the file that contains the firmware MSM tool uses to flash via edl, so maybe we can get a "cracked" msm tool/exe that dosent need login?

The site is: https://www.gsmmafia.com/oneplus-10-pro-flash-file/
Password: ne2210*@gsmmafia45
 
Last edited:
  • Like
Reactions: usama_92, null0seven and dladz
EtherealRemnant

EtherealRemnant

Senior Member
Sep 15, 2007
3,759
1,176
37
Denver, CO
It isn't possible to work around this new situation because the Sahara protocol used to communicate with the device has changed. My understanding is that the old software wouldn't work even if the ROM was repackaged into another device's MSM Tool.

It seems that from now on, MSM Tool requires a technician to flash, leaks are no good because it also seems like there is a token generation happening which means that even if the credentials leak, it won't do any good.

Maybe someone can disassemble the MSM Tool EXE itself and find a way to bypass/patch out the login requirement but I would think that they would have tried to protect against this too.
 
  • Like
Reactions: usama_92, dladz and tap77
g96818

g96818

Senior Member
Dec 27, 2014
534
154
you want to try use the oppo/realme ofp flash tools. I was researching this before, but gave up. oneplus is now part of oppo again, which is why it sucks.
 
  • Like
Reactions: dladz and tap77
dladz

dladz

Senior Member
Aug 24, 2010
14,274
4,803
Liverpool
Huawei Watch 2
OnePlus 8
There is always a way to crack a tool, always, even Denuvo can be cracked, it's just a matter of will and ability.

That's not to say that it wouldn't seem impossible, every check in has a fall back option, including this tool, i'd say lets get it available to all and some exposure, then i'm sure progress can be made, even if it leads to something else.

In all fairness though the options that the other guys have mentioned all seem to be pretty robust, personally i've never needed anything other than recovery on the 10 pro so i've maybe been lucky. Would be good to get some actual proof of concepts from people who've been in sticky situations, what worked, what didn't and where do we stand now.
 
  • Like
Reactions: EtherealRemnant and tap77
You must log in or register to reply here.

Similar threads

Metromas
Question OnePlus 10 Pro - QDLoader HS-USB - EDL Test Point [9008] MSM
Replies
57
Views
5K
Metromas
Metromas
U
Question Update OnePlus 10 Pro from HydrogenOS (CN) to OxygenOS (EU/GL/IN) without rooting
Replies
65
Views
11K
W
waldoud
Zeescorpion
Question Oneplus 10 pro bricked. Try to convert china colorOs to oxygenOs.
Replies
48
Views
6K
Metromas
Metromas
docnok63
How To Guide OnePlus 10 Pro Fastboot ROMs (and how to make for any device)
Replies
120
Views
7K
neelsolanki
neelsolanki
S
Question One plus 10 Pro OxygenOS 12 ROM where to download?
Replies
42
Views
5K
dladz
dladz

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 2
    HessNL
    HessNL
    Twiggy000b said:
    It'd be cool to see if this actually works, some of the bricked people try it lol
    Click to expand...
    Click to collapse
    If people can make this to work then I'm going to brick my device on purpose
    View
  • 5
    D
    DenisPDA
    Hi
    Please support the post on the OnePlus official forum

    Please share recovery tool (EDL mode) MSMDownloadTool for OnePlus 10 Pro

    Thanks
    View
    4
    J
    jeffsga88
    DenisPDA said:
    Hi
    Please support the post on the OnePlus official forum

    Please share recovery tool (EDL mode) MSMDownloadTool for OnePlus 10 Pro

    Thanks
    Click to expand...
    Click to collapse

    Unfortunately, I doubt that will help. What we really need is someone who is good at cracking software to crack the MSM tool for us. The site listed above ( https://www.gsmmafia.com/oneplus-10-pro-flash-file/ ) has all the different versions of the MSM tools, they are just locked down. Using x64dbg on the actual MSM tool just crashes the debugger (most likely security features detect it and force close the program). But from what I could tell, it's not the MSM tool that needs to be cracked necessarily. When you run the MSM tool it creates a new directory in local user app data where it extracts the .dll files and also a .exe file (can't remember the name but think it's something devui.exe or something). If you run this file, it's the login program for the MSM tool. You can load it in x64dbg without any crashing and edit it. I unfortunately wasn't able to figure it out and gave up, but if we can get someone with more knowledge and know how on this, we will have the MSM tools cracked. I would say maybe start a bounty, but not sure if it would be an issue with the mods as technically cracking software goes against the TOS. Either way, hopefully we can get it soon as having MSM just in case is always a good thing.

    Edit: So the name of the exe that is the login to the MSM tool is called FTGUIDev.exe and it's located in the AppData\Local\OPPO Flash Tool Series 3.0\ folder after trying to run the MSM tool. If anyone knows how to crack it, it should allow us to replace it and then use all of the MSM tools on that site.
    View
    4
    Renate
    Renate
    EtherealRemnant said:
    It isn't possible to work around this new situation because the Sahara protocol used to communicate with the device has changed.
    Click to expand...
    Click to collapse
    I don't have a One Plus 10 but I have curiousity and I know a bit about Sahara/Firehose
    I wouldn't think that the Sahara protocol itself has changed, that's in the PBL in ROM.
    It looks like the Firehose loader (prog_firehose_ddr.elf) has added some authentication stuff?
    It could be patched and resigned if Secure Boot is not enabled.
    Code: 
    /sources/services/tme_messages/src/ImageAuthPblUtils.cpp
boot_elf_auth.c
Auth Metadata
not authorized
Requesting VIP img authentication elf_buf = 0x%x, elf_buf_len = %d
Returned from verifying VIP img authentication: data = 0x%x, data_len = %d
Authenticate module requires buffer to be %d (0x%x) aligned, input buffer is not aligned Addr 0x%x size
VIP img authentication failed with smc_status = 0x%x, rsp_0 = 0x%x
Authentication of signed hash failed %d
Secure Boot *not* enabled BUT VIP *is* enabled. Therefore will *not* check digital signature on Digest Table. This allows easier testing on non-secure targets%c
    Gosh, I wish that I were a VIP!
    Still, there is something strange about this ELF, it doesn't look like my other loaders.
    View
    4
    D
    DenisPDA
    Greetings to all!
    I unpacked the ColorOS A12 OFP image https://mega.nz/folder/zAci1YrZ#-gNY7OJ3IsOo-SY6kV4VXQ
    Maybe someone can create it under QFil Tool v2.0.3.5

    Original image NE2210domestic_11_A.12_2022030701060000.zip
    OplusFlashTool_v3.0.16.20_for_Dev.zip (requires authorization)
    View
    3
    EtherealRemnant
    EtherealRemnant
    It isn't possible to work around this new situation because the Sahara protocol used to communicate with the device has changed. My understanding is that the old software wouldn't work even if the ROM was repackaged into another device's MSM Tool.

    It seems that from now on, MSM Tool requires a technician to flash, leaks are no good because it also seems like there is a token generation happening which means that even if the credentials leak, it won't do any good.

    Maybe someone can disassemble the MSM Tool EXE itself and find a way to bypass/patch out the login requirement but I would think that they would have tried to protect against this too.
    View

New posts