This can be used in future to flash rom/kernel/recovery in bootloader mode or other method ?
Release Compiled Version 1.0 · italorecife/OppoRealme-OFP-Flash
Compiled with Nuitka for Windows, Linux and macOS Linux (in the example below I will use ubuntu) Install adb & fastboot and simg2img sudo apt-get install android-tools-adb android-tools-fastboot s...github.com
General MSM TOOLS
- Thread starter tap77
- Start date
I will not confuse anyone here the thing is it is more like an msm tool for recovery for "ofp" files to get back to your stock android devices for realme/oppo/oneplus etc but in all you would be correct basically but this is just a simple (replacement) for oppo and oneplus tools (as long as your bootloader is fine!) so I recommend proceeding flashing things on your phone with caution.
It's imho completely different tool. So far it's ofp file flasher.
Ok, If I have understand....this can flash files only if bootloader work correclty, not if it is damaged ?
Unfortunately I also i facing the problem you all are debating here. Fortunately my phone is not bricked but I do wish to be able to flash another region firmware and since the bootloader cannot be unlocked on my model, a Realme GT2 European Version, i was looking for ways to flash it using EDL mode. I wanted that because the deep test APK from Realme is available only for the INDIAN version, witch obviously has another firmware.
The only thing that a i haven't tried since now is using the basic QFIL tool from Qualcomm after unpacking the ".ofp" file from the Indian firmware.
Do you guys think the QFIL could finally do this flashing process?
The only thing that a i haven't tried since now is using the basic QFIL tool from Qualcomm after unpacking the ".ofp" file from the Indian firmware.
Do you guys think the QFIL could finally do this flashing process?
Ok, to unlock bootloader we need a program it is true ? What program do we need ?
No we don't need any program to unlock bootloader on OnePlus 10 Pro (unless you're dealing with some carrier locked handsets). Not sure why there are another chinese devices mentioned here so often.
not really you'd have to extract the ofp file and look for the prog filehorse file and the raw images but i doubt even that will work since the qfil tool is so unreliable for newer oneplus models
well actually it depends on what kind of device you are using usually you can just simply unlock a boot loader with you have to go to developer settings on your phone and turn on "oem unlock" then go into the bootloader settings with pressing the power button and holding the down button "usually" then you just simply plug the device in while using cmd directed at the platform tools folder and hit "fastboot flashing unlock" and bam you are done i will link the tool as well!
SDK Platform Tools release notes | Android Developers
Android SDK Platform-Tools is a component for the Android SDK.
developer.android.com
I did find a decrypt tool for Oppo/OnePlus MSM files: https://github.com/bkerler/oppo_decrypt
I don't know if it works, and you will need the ofp file, however.
I don't know if it works, and you will need the ofp file, however.
Ok, it is easy I already know this method to unlock bootloader. Thank youwell actually it depends on what kind of device you are using usually you can just simply unlock a boot loader with you have to go to developer settings on your phone and turn on "oem unlock" then go into the bootloader settings with pressing the power button and holding the down button "usually" then you just simply plug the device in while using cmd directed at the platform tools folder and hit "fastboot flashing unlock" and bam you are done i will link the tool as well!
SDK Platform Tools release notes | Android Developers
Android SDK Platform-Tools is a component for the Android SDK.
Best Regards
How did you unlock your OnePlus 10 pro? I did the exact same as written, i know how to do this, but as soon as I use the command: fastboot oem unlock it says that it failed everytime, I've tried everything what's wrong with this Phone NE2215well actually it depends on what kind of device you are using usually you can just simply unlock a boot loader with you have to go to developer settings on your phone and turn on "oem unlock" then go into the bootloader settings with pressing the power button and holding the down button "usually" then you just simply plug the device in while using cmd directed at the platform tools folder and hit "fastboot flashing unlock" and bam you are done i will link the tool as well!
SDK Platform Tools release notes | Android Developers
Android SDK Platform-Tools is a component for the Android SDK.
Nah I did it with my 10t but however uhm it depends did you get yours from t mobile or?
That did the magic! It worked finally after millions years of research, never knew that this was the problem all this time
I do not have a TMobile version, the only problem was that I used an old command like the one used with the OnePlus 9 pro etc, greetings
I wish I could say you are being sarcastic.. But I think I already know the answer to that one..
EDIT: it did work? Glad to hear it helped!
oh lol yeah the reason why I assumed it may have been is because oneplus or tmobile is starting to stop people from unlocking their phones but glad it i has worked for you eventually
Similar threads
Top Liked Posts
-
2and just an fyi...ii meant for that tid bit of detail to leak out. 1st because i am in ho way ashamed of being on M-soft's hit list 20 yrs ago, for something that they were never able to prove i had any involvement in... ill stop there. But technically that actually was a rather nice ego boost, which i can carry for years.... minus the whole jail/fine threat. But lessons learned!.... Now as far as the mentioning of the other person... Ill just say this...
While its all fun, and challenging doing stuff like this... THIS is what XDA was all about, and still is, albeit a touch more censored, and less def-con than the early days... its still a well respected and diverse environment to share what weve learned or need to learn more! And yes while i take much enjoyment with finding new ways to make various mfg take notice that no matter how hard they push to restrict us... we will push back HARDER because we dont like being told how we CANT use something we paid $1,000 for! Ive dedicated countless Days.. now Weeks on this problem alone, and thats all good, cuz its us vs the establishment! When its all said and done, no one got hurt and some companies end up having to work harder to make their devices better!
But what the person i vaguely mentioned in the prev post is being accused of, is something i despise more than anything... and thats STEALING from the wallets, pockets, and bank accounts of everyday ppl like you & me. Corporations have BIG insurance policies that step in and keep companies afloat... like Binance... Coinbase.... both took massive losses over the years from bad players, but weeks later they were barely limping. But when you're involved in ANY way with a crypto-currency scam...on a personal level, and what you presented ppl, was nothing more than lies, false hope, and inflated numbers.... you are THE WORST kind of person! Thousands of ppl found that out the wrong way & for what it's worth... I hope he is caught soon, and answers for it. Dude was a bonafied Mensa member, and i knew him... Crappy attitude, but still a genius, like a younger Stephen Hawking. I was scammed by a girl like him. No details, but i had my nft wallet stolen and a Mutant Bayc Nft, along with 31 other tokens worth just under $107k taken under a false threat on her life.... which i later found out that SHE was the one who came up with the idea and the planning of it!
I never got justice... but i truly hope those people he victimized all do!
Sorry... off topic mods, so if you delete the post i totally understand, but i wanted to clear that up. I dont go spreading other ppl's dirty laundry carelessly like that.... I did it on purpose so i hope he reads this before they take it down! What a POS...
Sorry yall... didnt mean to drop a life rant, post. My bad!
2
yes... thats why i mentioned it here instead of dm.. so ppl might catch on and know to come ask someone in private about WHO... instead of just blindly getting ripped off by some rando!2
Dose these last 24 hrs and can be used on other MSM ...? or several Machines at same time..??2
ok... i order OTP...for you///its going to take a couple of minutes..to go through1
oh and sorry Renate... i wasnt ignoring you... i was actually putting SERIOUS thought to this question. and unfortunately working with the tables involved with breaking that level of cipher, i must always divest that level of process to either one of my EX - cohorts who is a math MAGICIAN , and also one of the 60k (ish) Mensans. And while i tried to reach out to him twice in the last few days, his wife made it very clear that he is quite possibly not going to be available for quite a while! It seems that she was visited by 2 Interpol ... agents i guess thats what they're called?? i have no clue... ive managed to stay off their radar and will continue doing so by keeping my head locked into trivial things like this stupid phone, lol. Ive had my massive legal scare at the hands of "M-soft" in 2003 under threat of a looooong prison sentence, coupled with a fine/restitution that i would be paying well into my 90's. All over an unfounded accusation regarding the original Xbox. BUT enough about that....
Umm... no i am not at all very savvy when it comes to cryptography. As i kinda hinted at earlier, I push most of my hash calcs thru eliminating the padded data around identified values... then from there i employ one of several of the online toolsets made just for that kind of infrastructure... but when you get to sha 256, even they may not be much use.... heres a few of them,,,, I dont wanna make the mods think weve veered off topic, so hopefully they take notice that you are apparently attempting to crack the Sahara/Firehose protocols....
ASN1
ASN1 - 2
i dont know if these might help you, but maybe they offer u some resource. unfortunately with cryptography you are a few leagues ahead of me in that ocean...
oh... and seriously .... NO ONE??? I mean i even offered to possibly offer a monetized incentive for a working POC of one of these root escalation cve that are floating around. sheesh..... well can ANYONE HERE, tell me if the Samsung TTS vulnerability , which was recent;y blasted all over the internet, something that existed in ALL TTS on android?? Cuz samsung makes it seem like it was a Google TTS flaw... which means that some versions of google tts could be retooled and then applied the same way.... because i found it to be 100% as easy as stated, and also part of my galaxy s10's current fw. I was able to extract the TTS app.... resign it to force it onto my OP 10T, and every step of the process works up to the shell spawning. It opens but with standard uid - 2000, vs the uid - 1000 on samsung, and im sure that is mainly because the original TTS app sits in the system / priv apps on a samsung cuz its native.... so if i could force a downgrade of google tts, to a vulnerable version, then i can pull the same trigger, and blast a System shell.... and thats enough to change the flags i need on my props. ***** my second question is: considering how ALL these mfg are identifying the "Google Downgrade" function that is being used by so many exploits because Google left a special app Downgrade function in their system... could anyone clue me in on how/whether i could employ this to downgrade the Oplus Engineering App, to a version thats say.... 5 years old??? if i have it.... which i do.... cuz if thats possible BY ANY MEANS, then i can just load the Engineering Apk with the built in Root Shell ! problem solved....
please commence with the barn-storming cuz someone here knows how this can be performed.... -
9BTW... I am STILL in need of someone to share me access to a MSM Tool account that is active... Again... i dont care if its a guest account... or regular. You can change your password 12 hours after you give me the login info.... I am VERY close to being able to spoof an authentication, and signature response back to the phone in order to allow generic flashing of the 2213, 2215, and 2217. I just need to do about 2, maybe 3 more flashes, an hour between each, so i can decipher the algorithm that generates the token for the response. I have 9... i need 12, as they are partially calculated by a timestamp. So ANYONE who can help me with an account that is active, and maybe it is close to expiring anyways, please DM me, with the info to gain access.
I am working under an authenticated letterhead, permissions document sent to me by Qualcomm, which completely supercedes ANY legal action brought forth by Oneplus/Oppo/BBK. The letter expressly provides me permission to use any of the tools/functions which are originated/derived from a Qualcomm Tool in any fashion. MSM is written and designed by qualcomm. I am permitted to use whatever, in the "Research, and Penetration Testing, of any and all protocols called upon by a function of any process that begins in a device with a qualcomm chipset.!"
They make the MSM Tool... but access to the servers which are used to flash each qualcomm device is controlled by their respective manufacturers.6so heres what the OTP guys are doing...
Be prepared... this is a VERY long detailed post...
so what they are basically doing is....
they are running their own "last pass" kind of server from AWS... Where they are daily logging in to their amazon web server account, and updating the MSM TOOL login, so that it refreshes every time one of them needs to pull an OTP. But its up to whoever admins the account as to how long tokens last for.
then they created (or cloned) that GA_Login tool, which is just a general purpose login tool which can be made to work with any app. It comes with modified code so that you can attach it to any program written under a certain language. (different versions of the login tool for different program languages) Then the tool officially has access to manipulate the login values of whatever app.
I believe the tool has legit licenses with the companies otherwise they would be violating the reverse engineering laws, and everyone who is profiting from it would be subject to an arresting offense! That would depend on the companies to press charges. But its easy to gain permission from a company for this purpose because you arent altering the code, only adding further security to mask passwords!
So the OTP being generated, are just a valid login that is masked by a secure password masking system. Unfortunately it is unable to be decrypted due to mitigations involved with packet capture and the login relies on an internet connection. Now unfortunately thru further inspection, the OFP flashing app DOES maintain a secure check of the VIP Authentication signature, and that signature is verified on the phone itself through a command called by the Linux Library "Libqmi" ... this can be built and programmed by anyone, but the actual procedure for JUST doing a VIP Auth signature, is not detailed on how to perform this.
THIS is what the QFIL application is doing when the sahara programmer is called.... the sahara programmer has a heavily encrypted HASHING ALGORITHM which sends one value to your phone, and then your phone verifies and calculates a response to send back to the Sahara.... The sahara already knows the correct answer even though it sits waiting, and if a single character is off, then sahara shuts down the communication portal, and sends us back an error. At that time, the phone is stuck in perpetual FAILED mode, and needs to be reset in order to try again.
The problem with this is that during a FULL BRICK state, meaning no communication without shorting the Test Points, while the battery is disconnected, then there is no way to get a valid time stamp from your device. The timestamp is part of the sahara's calculation. Thus this is why manually flashing thru QFIL continues to fail. The PATCHED Firehose loaders, simply have the TIMESTAMP requirement removed from the calculation, so that the only thing verified is the devices SOC and board information.
The MSM ONLINE tool, does its own timestamp calculations and intercepts the communication of the Sahara, then injects the current valid timestamp in real time, which then gives the approved signature to the sahara, and authorizes your flash.
Conclusion: Someone who has .elf file coding skills needs to completely disassemble the loader, which can be pulled from ANY OP 10series.... or actually ANY Snapdragon 845 r 1, based phone, and compare that to several other loaders of recent related chipsets... ie Snapdragon 845 r 2, or possibly even Snapdragon 865... but if they are fluent enough working with elf files, they should be able to locate the instruction code that requests a timestamp, as part of the signature, and delete/disable that requirement. THEN recompile that loader and we will have the file needed from OFFLINE flashes via the patched MSM Tool, or Qfil.
The login is the ONLY requirement of the MSMTool!
It is the sahara firehose itself that is killing our ability to continue flashing once the login is bypassed. Whether the phone is in brickstate or not has no value to the value being submitted to the sahara. OPPO programmed our phones to interrupt communication thru the USB, on a BUTTON, or ADB request to enter EDL mode. This is why when connecting via the command line, or thru the recovery mode shortcut, there is a slight 3-5 second delay until your phone is detected in 9008 mode.
1. When entering by holding the VOL buttons and plugging the usb in, the phone loses communication to the TIMESTAMP function, which makes the sahara fail offline, due to no MSM Tool server intervention. (remember the MSM server is not maintained by OPPO, but is actually built by Qualcomm... they just provide access to OPPO for repair functions.)
^^This will cause QFIL to fail, because a valid VIP cant be generated without the timestamp! ... But the MSM server can interject the correct timestamp being that its online and always in sync^^
2. When entering EDL via cli, the phone is SUPPOSED to go straight into QCOMM DOWNLOAD MODE... with no interruption, but OPPO amended a "Reboot" command into the opperand forcing the usb to lose connection to the board and breaking the sync, and thus forcing the timestamp to be invalid once the connection is made again with the programmer.
^^This is why COLOROS is a game changer... Because they pushed their own, RECOVERY, and FASTBOOT protocols as overlays of the REAL Qcomm Recovery and Fastboot. Recovery and Fastboot are requirements of Qcomm/Android devices. But HOW they are laid out to us are completely up to the manufacturers. The ColorOS Recovery, and Fastboot (D) that is made by OPPO, alters the timestamp being generated, to force a standard 12hr format instead of 24hr ... Sahara doesnt know wtf AM, or PM is... so anything from ColorOS is gibberish in the timestamp.
THERE IS ONE CAVEAT...
All androids with altered Fastboot and Recovery protocols, ,MUST include a "Debug Boot Image". These actually communicate to the Qualcomm diagnostic function. Although atm i have no idea how to BOOT into these images, as they are not the same as the normal .img files we use for everything else. Calling on one of these images, is a process completely different than standard android boot.img ... so again i believe this to be one of the functions of LIBQMI .... this library makes a connection to the device over usb but more importantly the SERIAL communicator console on the board. Once this communication is connected, you have full control over all partitions/filesystems inside the entire device, without regulation. You could technically tell your smartphone it is now a smart TOASTER, (but this would certainly crash immediately without the proper functions being built into the chipset.)
So now i task ANYONE who might have decent Linux knowledge to research QMI and how it communicates, to find the proper commands/access to call upon the Debug.img , which you can pull our of any downloaded fw.
I will still be working on alternate methods, but as of now QMI seems to be our only answer.
And final statement. OTP cannot be spoofed in any method to gain authorized MSM access, anymore than you being able to spoof authentication into a "last pass" account to gain control over someones password collection. They both maintain about the same level of encryption.
I hope thats detailed enough to get to everyones thoughts, as i probably wont be able to answer anything much deeper for the time being. I have personally put myself into a financial situation, by the amount of time i have devoted to this, and now need to create a miracle or 2 in order to recover from the domino effect that i hadnt realized i triggered until today. Sorry i couldnt do a hell of a lot more... if i had the financial resources to not worry about bills for a month or two i could totally crack this thing wide open, and probably put a devastating hurt on OPPO in the process... but Electricity, Rent, Car, Insurance, Food, and general living, all factor in to the amount of time i can spend on this. (which sucks because bounties are upwards of 50K or more for the discovery of holes in the functions i was working on, and according to Qcomm i was very close to a pretty high critical cve being declared!)
6
i dont recover THAT phone.... i have 2... a 10 Pro, and a 10T.... building the FREE version of the msmtool requires a TON of full captures of all the usb data being passed from device to software, to weed out the BS, and isolate the signature itself, then decrypt or find a way to spoof it.... But testing the method over and over on the exact same device does not produce me enough variables to know if my findings are valid FOR ME... which will help no one... or if they are valid for ALL ... and for that I need the data which my 10T will provide.The thing I don't understand is HOW you recover the phone after bricking it?))
Isn't this the point of all this efforts? To find a FREE way to flash the bricks?
the 10Pro uses the Snapdragon 8450... the 10T uses the Snapdragon 8475 ....
BOTH models use the same board config, TARO..... the only big difference is the cameras....
ive completely eliminated the sign on necessity for the tool... so far my mods have successfully patched out the entire login script. So on the newest MSMTool... mine opens right up to the choose your device screen, ... but there are 3 major verification checks that happen during the flag.... 3% a VIP or AUTH token is requested by the app... I think i have isolated the process on the phone that generates the validated response..... (1st good find... because that means if the next 2 are also generated BY the phone.... I can trash the hell out of the programming inside the MSM tool, that sends ANY KIND of network request!.... If all the tool needs the net for is the LOGIN, and everything else is validated by the phone, it proves the EDL flash can be completed offline! Tag in the LOOPBACK adapter again to fool MSM into thinking it is still online.... remove the login segment of the tool.... drop in a few shell commands to trigger the intents that i believe the AUTH signature are coming from.... and if that all goes well on 2 DIFFERENT devices, then i know it will work on ALL in the 10 series..... capice?
oh, and HOW i keep recovering my 10 Pro is thanks to a buddy who you have spoken with in the past few replies.... Canuck ... he is supplying me with OTP credits he purchased to help me do this research... each token lasts 24 hrs... which gives me around 2 - 300 flashes... IF i needed that many... but i usually pull about 10-12 ... i have captures of over 500 successful flashes and now have started finding REPEATED DATA overlapping thru several captures.... meaning none of that data is part of the encrypted AUTH signature... In my 27 years of programming... and 14 specifically with android... I have NEVER seen a truly encrypted Hash value EVER repeat the same sequence of an entire row of encrypted code... let alone even 64 characters..... well i have about 90 pages that have this in common! so that makes the amount of data i have to isolate even smaller..... more flashes.... more eliminations..... more repeating crypto segments overlapping on other flash captures, more characters i get to delete from my control group....
you see... THIS is old school hash calculating by reversing the code.... eventually you will have several lines of code which are 100% different on every full capture.... THAT CODE, is then used as a kind of reverse captain crrunch decoder ring..... you plug in some common fixed variables.... until you locate a set or maybe 10 sets that all produce the same exact "value tables" as i call them.... but more formally, the ALGORITHM that when applied , generates the exact number of characters required in a valid AUTH token, and then you plug that result into a blanked pre-formed response packet then replay or inject it via a script with the timing set for the correct intervals... and PRAY that you didnt miss some little variable way earlier which breaks your entire data set!.... (normally this doesnt happen.... but 9 out of 10 times i also dont have to work this hard to strip the tables from the encrypted packet. I usually have SEVERAL different attack platforms... or devices... game consoles.... files.... whatever it is that all are locked by the same apparatus, so i can generate much less collections of the info being sent between the Challenge and the Response packets.
think of it like this.... if you have to pick a barrel lock, but rather than force it open and damaging it, you instead opt to forge a master key...
to do this you would either need a model of the working key.... (like having the signature given to you... which isnt gonna happen...) OR you would need to get as many different keys that FIT the lock, as you can find...
Once you have a solid control set, ( copies of all of the keys that engaged at least 1 pin inside the tumbler without twisting or manipulation.... all of the tumblers pins MUST be engaged for the key to spin the lock to OPEN)
If you have 20 keys that all engage at least 1 pin... then you group them off by which pin they set... and now you have the ability to compare those in each group and find the matching cuts in the key. The more you have , the more you have to examine! The more you examine, the more you will find keys that overlap into other groups because some keys will engage more than 1 pin ..... now you get to eliminate ENTIRE GROUPS cuz u only need the one that matches 1 pin in multiple sets....
the goal is to get at least 10 grooves / cuts identified, so you can record the location and measurement of each working pin setting... depth... size and width of the groove... ( on lets say a Coke machine, it has a barrel (tumbler) lock that protects the money collector. Those usually have 10-set cuts in the barrel key ... you need all 10 cuts to be precise or the lock wont budge. BUT if you have 10 keys that each engage 1 different pin in the lock, you can map out the position, depth, and cut needed for each pin, and forge them onto a blank uncut barrel key using nothing more than a rotary tool and a diamond tip engraving bit.
once all your results are transferred onto the blank then you should be able to push it in the lock and turn the key with ease!
well the EXACT same idea structure works when cracking mathematical algorithms ...
in this case, having NOTHING but hundreds of copies of the same key will not help, as you need MORE different keys to isolate perfect segments, and eliminate garbage. well i actually have 2 keys... but 1 of them is being blocked from testing, by an immortal bouncer named T-Mobile Bootloader Lock!
( i dont know if humor helps other ppl relate to something, but it works wonderfully for me!)6GOOD GOOD... Thats what i like to hear from my Android Brethren !! Hack, Crack, Disassemble, and Attack the weaknesses of these infernal devices !!! (I need sleep!) ... Sorry, im stuck in some medieval, warfare mindset .. my bad! lol...
BUT heres what i came for: Humor me.....
IN THEORY... considering that EVERY post on the internet regarding DIAG mode on phone, (including IOS!) has started with the same goal.... "Using Root access, to enable Diag for access to the EFS" .... So basically everyone is saying that at the time... ROOT was horse... and Diag was the finish line! ... Right? Cuz thees guys were trying to hack bootloaders that had no accessible interface. And DIAG was their answer every time... and it worked! (Mostly)....
What i am proposing is NOT trying to hack the bootloader, because i already know how to crack that... But if it used to be a REQUIREMENT that to even discuss DIAG, you must have Root.... Then can ANYONE HERE put together a way, in which I could REVERSE that process.... or at least leverage DIAG MODE, to get myself a Root Shell.... or alter the SUID or even outright set a new user, as "UID 0" ... temporarily even if i can only force 1 app to see my account as SYSTEM, so that i can get RW access to Build.prop, or Local.Prop ?? Then i can make 1 flag change in it that will snowball me right thru the security and into the bootloader!
I mean as Diag I can literally DELETE the phone's whole identity! No imei.. no baseband... no modem... no mac address.. by the access i have to the EFS... and you cant even directly access that partition with ROOT ... only DIag and EDL have that authority! So imho there HAS TO BE a way to leverage a lower permission level thru some kind of console, where i can indirectly make a change to the build.prop. And i dont care if it Bricks the device 5 minutes later, cuz i am gonna make my change be locked with a persistent property that is already in place! It just needs a 1 in place of a 0, or an alternate access point which is also persistent, and just needs one word added to the line! Either way, if the phone bricks right after for some security violation, i will still have enough access to break the secure chain of trust and make my flags permanent! So if i have to pay for a flash to restore my phone, so be it... i know that the two things i edit survived an edl flash several times already!
I really need EVERYONE ON DECK for this... cuz getting this done will cut at least 50% of the work i need to build us an MSM - Mafia FREE edition. Im talking to the guys who still think UP UP DOWN DOWN LEFT RIGHT LEFT RIGHT B A Start, is a goof cheat code! As well as the people who can walk past an ATM machine, wave their hand in front of it, and 100's start spitting out like a money shooter... Yall cannot tell me that the Apple guys are better than us r/n ... cuz literally every time a new IOS drops... in less than a few days 3+ randos release videos as POC of them successfully gaining TFP0 , which is the IOS equivalent of ROOT.... I refuse to believe that the 17 y/o kid wearing a fedora, and a neckerchief, as they are walking up to the Starbucks counter to order their Venti Chai Mocha Latte..... NO .... I DO NOT ACCEPT THAT VISUAL! To me that worse than walking in on your parents smashing on top of the dining room table! ... at least then i know that they were making each other happy! ... But "Smuggy McMasterson III" strutting up to buy a lawn garden coctail from a coffee shop, while feeling all "chipper" cuz his team found a Kernel Memory Leak in 'IOS whogivesacrap beta 4' ... yet we cant find one privilege escalation, is the stuff of my nightmares!
YALL DONT WANNA GIVE ME NIGHTMARES DO YOU!!! I THOUGHT WE WERE FRIENDS!!!
FRIENDS DONT LET FRIENDS GET HANDLED BY A CRAPTASTIC BOOTLOADER, ,GUARDED BY 1 FLAG! COME ON! -
17I found out how to bypass the login prompt. Whether or not the tool will actually work is yet to be determined.
I don't have a oneplus 10 pro, but would be really curious if this works for anyone.
In order to avoid potential legal issues, and so you don't have to trust any files I upload, here are the instructions to crack the msm login...
Using a download from the previously-linked rar, you should have a copy of 'MsmDownloadTool.exe'
Use 7-zip to open the exe as an archive, and extract all the files into a new folder.
Open 'FTGUIDev.exe' with a hex editor (HxD is good)
Find the hex value '0f84e7000000b8'
Replace the 84 with an 85
Save the modified exe and launch it.
Choose a server other than 'in company'
Put whatever for userID/Password/Verify, click login.
I hope this is useful.
9BTW... I am STILL in need of someone to share me access to a MSM Tool account that is active... Again... i dont care if its a guest account... or regular. You can change your password 12 hours after you give me the login info.... I am VERY close to being able to spoof an authentication, and signature response back to the phone in order to allow generic flashing of the 2213, 2215, and 2217. I just need to do about 2, maybe 3 more flashes, an hour between each, so i can decipher the algorithm that generates the token for the response. I have 9... i need 12, as they are partially calculated by a timestamp. So ANYONE who can help me with an account that is active, and maybe it is close to expiring anyways, please DM me, with the info to gain access.
I am working under an authenticated letterhead, permissions document sent to me by Qualcomm, which completely supercedes ANY legal action brought forth by Oneplus/Oppo/BBK. The letter expressly provides me permission to use any of the tools/functions which are originated/derived from a Qualcomm Tool in any fashion. MSM is written and designed by qualcomm. I am permitted to use whatever, in the "Research, and Penetration Testing, of any and all protocols called upon by a function of any process that begins in a device with a qualcomm chipset.!"
They make the MSM Tool... but access to the servers which are used to flash each qualcomm device is controlled by their respective manufacturers.9Hello all, i am here to leak OPPO tech tool that allows one plus 10 pro to be flashed. Sadly i cannot share login but if you are able to bypass login screen the tool does not need to authenticate with server to flash device in EDL mode. Attached is screen shot of login screen and file. The tool picks up device in EDL mode and allows user to select the OPF file associated for device (please note you must have this downloaded externally ideally from msm tool for your device)
I wish you luck bypassing this login and fixing your phones.
6GOOD GOOD... Thats what i like to hear from my Android Brethren !! Hack, Crack, Disassemble, and Attack the weaknesses of these infernal devices !!! (I need sleep!) ... Sorry, im stuck in some medieval, warfare mindset .. my bad! lol...
BUT heres what i came for: Humor me.....
IN THEORY... considering that EVERY post on the internet regarding DIAG mode on phone, (including IOS!) has started with the same goal.... "Using Root access, to enable Diag for access to the EFS" .... So basically everyone is saying that at the time... ROOT was horse... and Diag was the finish line! ... Right? Cuz thees guys were trying to hack bootloaders that had no accessible interface. And DIAG was their answer every time... and it worked! (Mostly)....
What i am proposing is NOT trying to hack the bootloader, because i already know how to crack that... But if it used to be a REQUIREMENT that to even discuss DIAG, you must have Root.... Then can ANYONE HERE put together a way, in which I could REVERSE that process.... or at least leverage DIAG MODE, to get myself a Root Shell.... or alter the SUID or even outright set a new user, as "UID 0" ... temporarily even if i can only force 1 app to see my account as SYSTEM, so that i can get RW access to Build.prop, or Local.Prop ?? Then i can make 1 flag change in it that will snowball me right thru the security and into the bootloader!
I mean as Diag I can literally DELETE the phone's whole identity! No imei.. no baseband... no modem... no mac address.. by the access i have to the EFS... and you cant even directly access that partition with ROOT ... only DIag and EDL have that authority! So imho there HAS TO BE a way to leverage a lower permission level thru some kind of console, where i can indirectly make a change to the build.prop. And i dont care if it Bricks the device 5 minutes later, cuz i am gonna make my change be locked with a persistent property that is already in place! It just needs a 1 in place of a 0, or an alternate access point which is also persistent, and just needs one word added to the line! Either way, if the phone bricks right after for some security violation, i will still have enough access to break the secure chain of trust and make my flags permanent! So if i have to pay for a flash to restore my phone, so be it... i know that the two things i edit survived an edl flash several times already!
I really need EVERYONE ON DECK for this... cuz getting this done will cut at least 50% of the work i need to build us an MSM - Mafia FREE edition. Im talking to the guys who still think UP UP DOWN DOWN LEFT RIGHT LEFT RIGHT B A Start, is a goof cheat code! As well as the people who can walk past an ATM machine, wave their hand in front of it, and 100's start spitting out like a money shooter... Yall cannot tell me that the Apple guys are better than us r/n ... cuz literally every time a new IOS drops... in less than a few days 3+ randos release videos as POC of them successfully gaining TFP0 , which is the IOS equivalent of ROOT.... I refuse to believe that the 17 y/o kid wearing a fedora, and a neckerchief, as they are walking up to the Starbucks counter to order their Venti Chai Mocha Latte..... NO .... I DO NOT ACCEPT THAT VISUAL! To me that worse than walking in on your parents smashing on top of the dining room table! ... at least then i know that they were making each other happy! ... But "Smuggy McMasterson III" strutting up to buy a lawn garden coctail from a coffee shop, while feeling all "chipper" cuz his team found a Kernel Memory Leak in 'IOS whogivesacrap beta 4' ... yet we cant find one privilege escalation, is the stuff of my nightmares!
YALL DONT WANNA GIVE ME NIGHTMARES DO YOU!!! I THOUGHT WE WERE FRIENDS!!!
FRIENDS DONT LET FRIENDS GET HANDLED BY A CRAPTASTIC BOOTLOADER, ,GUARDED BY 1 FLAG! COME ON!
