General MSM TOOLS

[beatbreakee]

And for everyone saying Fastboot bricked their phone after flashing a fw directly ... You are PARTIALLY right... What actually happened is that EACH region's fw, has a specific manifest file (looks like "10001011" which cues which partiioning scheme to use for flashing. Using the 2213 .... 2211.... 2215 FULL Fw package has literally no bearing on what is going to be installed on your phone.... Other than Cosmetic, as in when you go to About Phone, your model and build details will all reflect whatever you think you flashed... But then taking the phone into DIag Mode, and reading the EFS partition with the ACTUAL fw information that is installed on your phone, will have at least 4 (all ive located so far) different files hidden in plain sight, but odd locations like 8 blank folders that only have another blank folder in them.... 8 levels deep, then 1 single TXT file that has NOTHING in it but your FACTORY BUILD DATA from when it was programmed at factory.... then a few details later, the EXACT Region, Model, Imei, and ESN that your phone is supposed to be running.... and flags that clearly state "FALSE" on every fw related line where it shows that the phone checks whether or not you have permission to do any modifications or replace those files. THAT IS YOUR BRICK!.... It shows permission to change ALL of these files, as FALSE.... so your phone is set to do all actions quietly... so when these files FAIL to get changed by the FW you just flashed... it is an instant device conflict the moment you press power.... Cuz you have mismatched Region specific code and files missing.

abl
cpucp
dtbo
engineering_cdt
modem
my_engineering
my_manifest
my_region
odm
recovery
vbmeta
xbl
xbl_ramdump

I might have missed 1 or 2, but it EXPLICITLY states <Permission_Granted>False<....
next to all of these files in a config file that is hidden in at least 4 different places in the EFS. It would be a NIGHTMARE chasing down the instruction that assigns the location of those conf files, so that you could either delete the entire instruction, or what i did... which was to use Android AGAINST ITSELF....

When i realized they could hide these conf files ANYWHERE and then drop instructions in any part of the Initrc, secure trust zone, bootloader, recovery ... ANYWHERE... then write one instruction somewhere that tells the phone to verif the hash of those files before proceeding..... i knew that was a losing strategy! I found copies of that SAME files content, WORD FOR WORD, in random "db folder" but were named without an extension at all.... same 1st name, but no extension.... adding txt did not let me open them either, except to a bunch of glyphs that looked like hundreds of characters stacked over each other, Like if you wrote a word, then used a darker pen and wrote something else.... then again... and again... and again.... but using some windows apps i was able to find what program was needed to read that file, and when i installed it, and renamed the extension to whatever it sad to, then the file opened and looked EXACTLY like the plain text ones i found in other places.

Wanna know the WEIRDEST PART??? ALL OF THESE FILES... EVERY ONE already has FULL RWX permissions granted to the folder and the files themselves!.... why go to ALL THIS CRAZY , with hiding... renaming....forcing special tools.... and duplicating, if you are just gonna make the files RWX by default to ANYONE? Im sorry but i think Oneplus/Oppo called every place they have an office/development facility, and broke the whole Oxy 12 into like 20 different sections, then gave each office 1 section and said "Complete your section... dont worry about building the OS.... just make sure your part works in an emulator.... then once complete send your completed data to the main office. They will BANDAID all the sections together, so that there is not 1 single center who knows WTH is really going on with this fw... then theres no leaks.... security breaches... nothing will matter because itll look so retarded that EVERY developer or highly technical user, will take one look and give up when they see then level of disorganization, and abnormal data structures we "Frankenstein'd" together to break their creative thought process!" --- OPPO CEO


tl'dr - device will still respond to ISP Pinout/Touch Point connection, WITHOUT the battery connected. You can proceed to have someone remote flash you
once jumpered and connected. Use windows and keep "Device Manager"
open. You will be able to watch and know when EDL becomes ready, and if the jumper becomes disconnected. Total flash time is about 7 minutes!

hope that shed a little more light on whats happening!

cheers

 

[Ph0nysk1nk]

I

And for everyone saying Fastboot bricked their phone after flashing a fw directly ... You are PARTIALLY right... What actually happened is that EACH region's fw, has a specific manifest file (looks like "10001011" which cues which partiioning scheme to use for flashing. Using the 2213 .... 2211.... 2215 FULL Fw package has literally no bearing on what is going to be installed on your phone.... Other than Cosmetic, as in when you go to About Phone, your model and build details will all reflect whatever you think you flashed... But then taking the phone into DIag Mode, and reading the EFS partition with the ACTUAL fw information that is installed on your phone, will have at least 4 (all ive located so far) different files hidden in plain sight, but odd locations like 8 blank folders that only have another blank folder in them.... 8 levels deep, then 1 single TXT file that has NOTHING in it but your FACTORY BUILD DATA from when it was programmed at factory.... then a few details later, the EXACT Region, Model, Imei, and ESN that your phone is supposed to be running.... and flags that clearly state "FALSE" on every fw related line where it shows that the phone checks whether or not you have permission to do any modifications or replace those files. THAT IS YOUR BRICK!.... It shows permission to change ALL of these files, as FALSE.... so your phone is set to do all actions quietly... so when these files FAIL to get changed by the FW you just flashed... it is an instant device conflict the moment you press power.... Cuz you have mismatched Region specific code and files missing.

abl
cpucp
dtbo
engineering_cdt
modem
my_engineering
my_manifest
my_region
odm
recovery
vbmeta
xbl
xbl_ramdump

I might have missed 1 or 2, but it EXPLICITLY states <Permission_Granted>False<....
next to all of these files in a config file that is hidden in at least 4 different places in the EFS. It would be a NIGHTMARE chasing down the instruction that assigns the location of those conf files, so that you could either delete the entire instruction, or what i did... which was to use Android AGAINST ITSELF....

When i realized they could hide these conf files ANYWHERE and then drop instructions in any part of the Initrc, secure trust zone, bootloader, recovery ... ANYWHERE... then write one instruction somewhere that tells the phone to verif the hash of those files before proceeding..... i knew that was a losing strategy! I found copies of that SAME files content, WORD FOR WORD, in random "db folder" but were named without an extension at all.... same 1st name, but no extension.... adding txt did not let me open them either, except to a bunch of glyphs that looked like hundreds of characters stacked over each other, Like if you wrote a word, then used a darker pen and wrote something else.... then again... and again... and again.... but using some windows apps i was able to find what program was needed to read that file, and when i installed it, and renamed the extension to whatever it sad to, then the file opened and looked EXACTLY like the plain text ones i found in other places.

Wanna know the WEIRDEST PART??? ALL OF THESE FILES... EVERY ONE already has FULL RWX permissions granted to the folder and the files themselves!.... why go to ALL THIS CRAZY , with hiding... renaming....forcing special tools.... and duplicating, if you are just gonna make the files RWX by default to ANYONE? Im sorry but i think Oneplus/Oppo called every place they have an office/development facility, and broke the whole Oxy 12 into like 20 different sections, then gave each office 1 section and said "Complete your section... dont worry about building the OS.... just make sure your part works in an emulator.... then once complete send your completed data to the main office. They will BANDAID all the sections together, so that there is not 1 single center who knows WTH is really going on with this fw... then theres no leaks.... security breaches... nothing will matter because itll look so retarded that EVERY developer or highly technical user, will take one look and give up when they see then level of disorganization, and abnormal data structures we "Frankenstein'd" together to break their creative thought process!" --- OPPO CEO


tl'dr - device will still respond to ISP Pinout/Touch Point connection, WITHOUT the battery connected. You can proceed to have someone remote flash you
once jumpered and connected. Use windows and keep "Device Manager"
open. You will be able to watch and know when EDL becomes ready, and if the jumper becomes disconnected. Total flash time is about 7 minutes!

hope that shed a little more light on whats happening!

cheers

I really hope you are able to pull off your Frankenstein MSM and end this insanity

 

[beatbreakee]

These ALL come inside EVERY OFP firmware you download,. Only official OPPO signed OFP will flash from MSM, or QFIL (if you have the authorized VIP addon) , so it does not matter WHAT you think youre flashing to your phone. It will say whatever in the about phone, and in the phones identifiers.... but checking the EFS folders data afterwards will say exactly what REAL region your phone uses... what fw is supposed to be instlaled, and how many times you have flashed NON AUTHORIZED fw packages to it. (That is if youre lucky enough to pull off a region change without bricking or infinite bootloop.) EVERY phone i have changed the fw on for my friends/local customers, has had 100% success .... The only brick i had that was NOT done on purpose by me, was the very 1st brick i had that killed my phone completely.... after that using the exact instructions i posted in other threads, i have had 0 hangups, and a perfect flash each time. Be warned though... you are going to always end up on a LOW revision of Android 12 , if you want to be able to still use your phone after the region swap!

Something that was programmed in to all the fw released after July 2022 have some "Region Control" policy lying in wait like a Tiger waiting to attack.... the moment you put a sim from a different region/carier into your phone AFTER changing the region, and then updating to more current fw. To have a fully functional device you HAVE TO STAY on the rollback package detailed in my instructions... i cannot express this enough. I have spent MONTHS now trying to break the policy, or circumvent the security, and it just isnt possible r/n in my eyes, because it is a policy written DIRECTLY into the critical functions of Android 12 late builds and android 13 all! A custom rom is about the only thing i think that would MAYBE break thru. But im sure ALOT will not pay any attention, then will msg me over and over asking for my help fixing whatever they broke. My instructions AS THEY STAND NOW work flawlessly on 10 Pro Tmobile to any region , and 10T T-mobile to any region.... but failure to follow step by step or skip any process will DEFINITELY end in bootloop or unresponsive. ADVICE: Just wait... i am fully confident someone will BREAK this whole MSM/Device Policy junk in the next 1-2 months. it will happen!

 

[beatbreakee]

I

I really hope you are able to pull off your Frankenstein MSM and end this insanity

i wont lie man... its looking bleak... 1st off the people who can get guest logins or shared info to the Authorized MSM tool are just not willing to share with me... If i cannot get access to the real authentication, and signature packets for a few different flashes, then i cannot put together the partially broken responses needed to allow anyone to load in their machine. As of right now, I can load and flash my Oneplus 10Pro as many times as i want from MSM... but the moment i switch to a different phone, it breaks the authentication and signature, and shows as expired. So i am not providing a GENERIC enough response yet to fool the server, so i need about 2 or 3 more brick - restores from an authorized account, so i can diff the data and see about ripping enough to push the package forward, but not enough so that it is looking for a specific device... or that will do yall no good. BUT IM TRYING! i just meed more cooperation from a couple ppl who can capture the login info during a remote repair, so i can log in with REAL info....

waiting patiently!

 

[Renate]

...set a jumper on the Test Points, (And it has to stay in place the whole time in EDL)...

I don't have a One Plus, but I dive pretty deep into EDL. I've never seen that the ROM bootloader reacts any differently when the "EDL test points" are shorted constantly vs. just shorted at the instant of the reset. I use magnetic reed switches on a few devices and I don't see any difference when I leave the magnet on them. I also had a device with a slide switch.

I'm interested in "VIP". I see that built into about a third of the Firehose loaders that I've checked. Still, I haven't chased that down at all.

I do have Lenovo/Motorola Firehose loaders that have "range restricted" based on a secure setting. It appears to be set in OTP fuses?

Any words of wisdom? You can PM me too.

 

[forever_lol]

Been in your EXACT same state bro... Too bad you already RMA... your device is just in what Qualcomm calls "Deep Sleep" . It is a mode to protect the volatile file system from further corruption, after attempting to flash a firmware that had Size/Compatibility/Manifest conflicts that would have otherwise been NON-recoverable if the system had went ahead and allowed the "Newly flashed" fw to finish processing. Basically it goes to sleep to prevent a hard brick!

BUT if you open the back of the phone, and set a jumper on the Test Points, (And it has to stay in place the whole time in EDL) Your phone will be recognized in 9008 Downloader mode ,,,, BUT WITHOUT THE BATTERY CONNECTED. Then after 10 sec in DL mode, if you have a QPST server window open, and you click connect, but dont flash anything, your device will auto change over to DIAG mode, for interaction with EFS File Explorer.

Theres ALOT of work that needs to be done (several files and conf in the EFS that you need to either delete, or change some info, and one particular
"CarrierPolicy.xml" which needs to be refined, and then your phone would allow you to reboot back to normal powered state. and send you automatically into Fastnoot. (I have tested and whittled down to exactly what needs to be edited, and purposely bricked my 10Pro about 15 times to make sure my technique worked)

I wont disclose publicly because of a "Cease and Desist" Order i received from BBK/Oppo ... as they have threatened in letter #3 to push Qualcomm to also invoke the "Reverse Engineering Clause" as i use Authorized QXDM and QPST programs that are modified to remove license checks. But what i can say in public is that "It does not matter WHAT STATE YOUR PHONE IS IN... Bricked.... Unresponsive...... Looped..... as long as you are willing and can access the main board of any Qualcomm phone...... You can bring it back to life, with these tools! In extreme curcumstances, all you need is someone with an authorized MSM account, and once you short the ISP Pinout /Test Point connectors. your phone skips ALL layers of the Android file system, and goes into a special "Security Free" emergency download instance of 9008 Download mode.... Both appear similar... but normal EDL by buttons, or ADB commands, has "Secure Trust Zone, and Secure Boot" both active and on guard to make sure you have the permissions authorized by Qualcomm. Using the Test Points only activates 1 security, which is Qualcomm's VIP mode. That is THEIR protection against catastrophic damage to the filesystem. If you DONT have a QUALCOMM Signed Loader/Programmer, you will fail VIP Auth, and the flash will crash. But in this EDL someone can MSMTool flash your phone remotely with no problem!

Cheers

Thank you for your thorough reply mate. Wow that’s actually the most informative reply i’ve ever received here on xda if i didn’t already register rma i would certainly follow your guide.

 

[anawilliam850]

I woul tried every tools that you guys are recommend

 

[beatbreakee]

I don't have a One Plus, but I dive pretty deep into EDL. I've never seen that the ROM bootloader reacts any differently when the "EDL test points" are shorted constantly vs. just shorted at the instant of the reset. I use magnetic reed switches on a few devices and I don't see any difference when I leave the magnet on them. I also had a device with a slide switch.

I'm interested in "VIP". I see that built into about a third of the Firehose loaders that I've checked. Still, I haven't chased that down at all.

I do have Lenovo/Motorola Firehose loaders that have "range restricted" based on a secure setting. It appears to be set in OTP fuses?

Any words of wisdom? You can PM me too.

ok... its just basic qualcomm science.... when you activate QDLOADER 9008 (EDL) by holding the Vol +, and Vol - buttons, you are allowing the phones PRELOADER to send the signal to boot into EDL mode. By doing this you run into security that can be set by the manufacturer as well as the carrier. (This is 100% validated in the T-Mobile variants of the 10Pro and 10T... as both models have a bit set by the pre-loader which forces the phone to NOT allow changes to several hidden files, which are the exact reason why attempting to flash ANYTHING over a Tmobile fw, even if the device is sim unlocked and bootloader unlocked, the phone will bootloop because of the security function of a single bit, inside the preloader. And if you flash reaching the bootloop stage, and then you continue attempting to force flash additional roms trying to get out of the bootloop, the RPMB Fuse will blow and that is what then triggers the unresponsive state.

(Read ANY of my past threads and you will easily find that most everyone on here KNOW that i have extensive knowledge of what i am speaking of here. I literally am prob one of the more Expert persons here in regards to THIS DEVICE, and the 10T when it comes to everything EDL/Brick/Unbrick. I have the ENTIRE QXDM suite of 44 applications all that work intricately in one or more of the 9 protocols that qualcomm tools perform specific functions to edit EDL, DIAG, QDSS, RMNET, DPL, SERIAL, QDSS_MDM, or ADB accessed parameters in our devices.)

now without wasting further time on my qualifications.... my point is that:

1. When the phone is connected to the battery, and then EDL is activated thru the BUTTONS, then it must go thru the initial security in the preloader. This is just plain sense, because the button configs used to access Fastboot, Edl, or Recovery mode, are controlled by the ABL, and can be removed, changed, or outright disabled by the OS providers. In example... i have a Tmobile Oneplus 10T, and it does NOT have fastboot mode AT ALL... not accessible, and when i pull the ABL partition, and use binwalk, and Ida pro to decompile and read the functions that are available, the FASTBOOT_HAL is not present at all... Tmobile did this to the 10T that were shipped after July this year.

2. When accessing EDL via Test Points... THE TRUE WAY, is to disconnect the battery connectors to the board. THEN place a jumper on the test points, and once set then plug the phone into your computer.
THIS METHOD bypasses the preloader, and goes directly into a deep or low level flash mode. You can tell the difference by simply pressing the Vol +, Vol - , and Power buttons - 1 time... like press them all together once... dont hold them, while the phone is already booted into EDL (9008) mode. If you have QPST open when you do this, your phone will automatically switch to DIAG, and run a built in DUMP command without any interaction by you. (the purpose of the dump created , i havent figured out, but this is part of the LOW LEVEL access function of EDL) Yes the VIP is still enabled, because that is Qualcomm's security feature... but in this EDL state, you can go straight into EFS Explorer, and read/write directly to the entire EFS partition. This is where Device policies, carrier policies, imei, nv, boot configs, simlocks, and much more can be altered, without any way for the phone to refuse your changes.

(It is not widely known, nor promoted because you can SEVERELY F' YOUR DEVICE UP, in this state. It is direct EFS writing, without any safety mechanisms to fix whatever you break. Change or delete the wrong file / config here, and you can turn your $600 phone into a REAL paperweight! As in, WILL NOT EVER FUNCTION AGAIN. I know of 3 different XML files in this folder which if deleted, or altered with invalid data, will DISABLE the 9008 protocol completely, and forever lock your phone in a perpetual deep sleep. The ONLY way out of it is to remove the SOC and replace it. These files cannot be edited, or even parsed when connected thru normal means either via "adb reboot edl", or button config. Those 2 methods each have their own level of restriction built in... but Test Point access removes every security other than the Sahara Firehose, and VIP Sign ... other than QFIL, and MSM, only certain Qualcomm programs can communicate in these modes, and the programs all require either a QXDM license, or the QPST server running, in order to launch the apps.)

 

[Metromas]

ok... its just basic qualcomm science.... when you activate QDLOADER 9008 (EDL) by holding the Vol +, and Vol - buttons, you are allowing the phones PRELOADER to send the signal to boot into EDL mode. By doing this you run into security that can be set by the manufacturer as well as the carrier. (This is 100% validated in the T-Mobile variants of the 10Pro and 10T... as both models have a bit set by the pre-loader which forces the phone to NOT allow changes to several hidden files, which are the exact reason why attempting to flash ANYTHING over a Tmobile fw, even if the device is sim unlocked and bootloader unlocked, the phone will bootloop because of the security function of a single bit, inside the preloader. And if you flash reaching the bootloop stage, and then you continue attempting to force flash additional roms trying to get out of the bootloop, the RPMB Fuse will blow and that is what then triggers the unresponsive state.

(Read ANY of my past threads and you will easily find that most everyone on here KNOW that i have extensive knowledge of what i am speaking of here. I literally am prob one of the more Expert persons here in regards to THIS DEVICE, and the 10T when it comes to everything EDL/Brick/Unbrick. I have the ENTIRE QXDM suite of 44 applications all that work intricately in one or more of the 9 protocols that qualcomm tools perform specific functions to edit EDL, DIAG, QDSS, RMNET, DPL, SERIAL, QDSS_MDM, or ADB accessed parameters in our devices.)

now without wasting further time on my qualifications.... my point is that:

1. When the phone is connected to the battery, and then EDL is activated thru the BUTTONS, then it must go thru the initial security in the preloader. This is just plain sense, because the button configs used to access Fastboot, Edl, or Recovery mode, are controlled by the ABL, and can be removed, changed, or outright disabled by the OS providers. In example... i have a Tmobile Oneplus 10T, and it does NOT have fastboot mode AT ALL... not accessible, and when i pull the ABL partition, and use binwalk, and Ida pro to decompile and read the functions that are available, the FASTBOOT_HAL is not present at all... Tmobile did this to the 10T that were shipped after July this year.

2. When accessing EDL via Test Points... THE TRUE WAY, is to disconnect the battery connectors to the board. THEN place a jumper on the test points, and once set then plug the phone into your computer.
THIS METHOD bypasses the preloader, and goes directly into a deep or low level flash mode. You can tell the difference by simply pressing the Vol +, Vol - , and Power buttons - 1 time... like press them all together once... dont hold them, while the phone is already booted into EDL (9008) mode. If you have QPST open when you do this, your phone will automatically switch to DIAG, and run a built in DUMP command without any interaction by you. (the purpose of the dump created , i havent figured out, but this is part of the LOW LEVEL access function of EDL) Yes the VIP is still enabled, because that is Qualcomm's security feature... but in this EDL state, you can go straight into EFS Explorer, and read/write directly to the entire EFS partition. This is where Device policies, carrier policies, imei, nv, boot configs, simlocks, and much more can be altered, without any way for the phone to refuse your changes.

(It is not widely known, nor promoted because you can SEVERELY F' YOUR DEVICE UP, in this state. It is direct EFS writing, without any safety mechanisms to fix whatever you break. Change or delete the wrong file / config here, and you can turn your $600 phone into a REAL paperweight! As in, WILL NOT EVER FUNCTION AGAIN. I know of 3 different XML files in this folder which if deleted, or altered with invalid data, will DISABLE the 9008 protocol completely, and forever lock your phone in a perpetual deep sleep. The ONLY way out of it is to remove the SOC and replace it. These files cannot be edited, or even parsed when connected thru normal means either via "adb reboot edl", or button config. Those 2 methods each have their own level of restriction built in... but Test Point access removes every security other than the Sahara Firehose, and VIP Sign ... other than QFIL, and MSM, only certain Qualcomm programs can communicate in these modes, and the programs all require either a QXDM license, or the QPST server running, in order to launch the apps.)

Is it possible to create tools for 10 pro if I run authorized account? I have used many 10 pro devices for a long time and still no tool has come out all this time..
Even the real account holder pays money. When we get it for use, we have to spend. so it cannot be shared publicly. If it is shared publicly, the company will notice this account. (Requires verification.) Unfortunately, there is no way, as it will end badly, don't be angry with me.

 

[Renate]

Thanks @beatbreakee for your response.
I do know that button activation of EDL and even "EDL mode USB cables" is dependent somewhere on other software.
Still, I'm pretty sure that a hard reset with high (1.8V) asserted on GPIO57 (on this particular device) will always get me to 9008.
Now, there may be OTP fuses that can ruin this for me, but there can't be anything in flash, because I can just disable flash too. Maybe the files are checked and can blow an OTP. That seems a risky thing for a manufacturer to do.
Sahara has to work without any flash or any RAM.

 

[Ph0nysk1nk]

Is it possible to create tools for 10 pro if I run authorized account? I have used many 10 pro devices for a long time and still no tool has come out all this time..
Even the real account holder pays money. When we get it for use, we have to spend. so it cannot be shared publicly. If it is shared publicly, the company will notice this account. (Requires verification.) Unfortunately, there is no way, as it will end badly, don't be angry with me.

Just out I'm sure curiosity, are those account holders independent repair shops who work out a deal with OPPO?

Or can only authorized OPPO centers hold accounts.

 

[beatbreakee]

BTW... I am STILL in need of someone to share me access to a MSM Tool account that is active... Again... i dont care if its a guest account... or regular. You can change your password 12 hours after you give me the login info.... I am VERY close to being able to spoof an authentication, and signature response back to the phone in order to allow generic flashing of the 2213, 2215, and 2217. I just need to do about 2, maybe 3 more flashes, an hour between each, so i can decipher the algorithm that generates the token for the response. I have 9... i need 12, as they are partially calculated by a timestamp. So ANYONE who can help me with an account that is active, and maybe it is close to expiring anyways, please DM me, with the info to gain access.

I am working under an authenticated letterhead, permissions document sent to me by Qualcomm, which completely supercedes ANY legal action brought forth by Oneplus/Oppo/BBK. The letter expressly provides me permission to use any of the tools/functions which are originated/derived from a Qualcomm Tool in any fashion. MSM is written and designed by qualcomm. I am permitted to use whatever, in the "Research, and Penetration Testing, of any and all protocols called upon by a function of any process that begins in a device with a qualcomm chipset.!"

They make the MSM Tool... but access to the servers which are used to flash each qualcomm device is controlled by their respective manufacturers.

 

[Ph0nysk1nk]

BTW... I am STILL in need of someone to share me access to a MSM Tool account that is active... Again... i dont care if its a guest account... or regular. You can change your password 12 hours after you give me the login info.... I am VERY close to being able to spoof an authentication, and signature response back to the phone in order to allow generic flashing of the 2213, 2215, and 2217. I just need to do about 2, maybe 3 more flashes, an hour between each, so i can decipher the algorithm that generates the token for the response. I have 9... i need 12, as they are partially calculated by a timestamp. So ANYONE who can help me with an account that is active, and maybe it is close to expiring anyways, please DM me, with the info to gain access.

I am working under an authenticated letterhead, permissions document sent to me by Qualcomm, which completely supercedes ANY legal action brought forth by Oneplus/Oppo/BBK. The letter expressly provides me permission to use any of the tools/functions which are originated/derived from a Qualcomm Tool in any fashion. MSM is written and designed by qualcomm. I am permitted to use whatever, in the "Research, and Penetration Testing, of any and all protocols called upon by a function of any process that begins in a device with a qualcomm chipset.!"

They make the MSM Tool... but access to the servers which are used to flash each qualcomm device is controlled by their respective manufacturers.

MVP of the year

 

[Metromas]

BTW... I am STILL in need of someone to share me access to a MSM Tool account that is active... Again... i dont care if its a guest account... or regular. You can change your password 12 hours after you give me the login info.... I am VERY close to being able to spoof an authentication, and signature response back to the phone in order to allow generic flashing of the 2213, 2215, and 2217. I just need to do about 2, maybe 3 more flashes, an hour between each, so i can decipher the algorithm that generates the token for the response. I have 9... i need 12, as they are partially calculated by a timestamp. So ANYONE who can help me with an account that is active, and maybe it is close to expiring anyways, please DM me, with the info to gain access.

I am working under an authenticated letterhead, permissions document sent to me by Qualcomm, which completely supercedes ANY legal action brought forth by Oneplus/Oppo/BBK. The letter expressly provides me permission to use any of the tools/functions which are originated/derived from a Qualcomm Tool in any fashion. MSM is written and designed by qualcomm. I am permitted to use whatever, in the "Research, and Penetration Testing, of any and all protocols called upon by a function of any process that begins in a device with a qualcomm chipset.!"

They make the MSM Tool... but access to the servers which are used to flash each qualcomm device is controlled by their respective manufacturers.

I have forwarded the relevant issue to the system technician registered user owner. I hope they allow it.

Just out I'm sure curiosity, are those account holders independent repair shops who work out a deal with OPPO?

Or can only authorized OPPO centers hold accounts.

I think it is done with fraudulent applications that are used without permission from oppo, making money. But no one is helping because it saves money for the goddamn tool. I think most likely employees are secretly using their accounts.

BTW... I am STILL in need of someone to share me access to a MSM Tool account that is active... Again... i dont care if its a guest account... or regular. You can change your password 12 hours after you give me the login info.... I am VERY close to being able to spoof an authentication, and signature response back to the phone in order to allow generic flashing of the 2213, 2215, and 2217. I just need to do about 2, maybe 3 more flashes, an hour between each, so i can decipher the algorithm that generates the token for the response. I have 9... i need 12, as they are partially calculated by a timestamp. So ANYONE who can help me with an account that is active, and maybe it is close to expiring anyways, please DM me, with the info to gain access.

I am working under an authenticated letterhead, permissions document sent to me by Qualcomm, which completely supercedes ANY legal action brought forth by Oneplus/Oppo/BBK. The letter expressly provides me permission to use any of the tools/functions which are originated/derived from a Qualcomm Tool in any fashion. MSM is written and designed by qualcomm. I am permitted to use whatever, in the "Research, and Penetration Testing, of any and all protocols called upon by a function of any process that begins in a device with a qualcomm chipset.!"

They make the MSM Tool... but access to the servers which are used to flash each qualcomm device is controlled by their respective manufacturers.

The information I get is limited to this. Is there any place to apply? if so where?.. In order for the account to be transmitted as it is, OTP verification, which is a separate query, is also required.

 

[gllark]

Hi everybody, I´m reading this thread for a few days now and would love to support the progress of @beatbreakee to get a tool which could bring us nearer to the development of custom roms. If he only needs a few flashes to get things done, why don´t we finance him with a few donations to buy these flashes? My first 10 bucks would be in if he names us a paypal account for it. Come on guys, this should be not so hard!

 

[Daniha]

if i arrange remote season is there anyway to note PW? i mean if he copy paste
then which is the best way to capture this PW? after i think i can share pw with beatbreakee

 

[Metromas]

Hi everybody, I´m reading this thread for a few days now and would love to support the progress of @beatbreakee to get a tool which could bring us nearer to the development of custom roms. If he only needs a few flashes to get things done, why don´t we finance him with a few donations to buy these flashes? My first 10 bucks would be in if he names us a paypal account for it. Come on guys, this should be not so hard!

ME TOO.
@beatbreakee
i spent $30 on someone to get new information. Downloaded 1 driver file and xloader, then started msm program and ran xloader. however, he installed the 9008 driver and when he was done, he DELETED the driver. There must be something to it, especially since you wiped the drive.

INFO: installed file is: NE2210domestic_11_A.07_2022011114400122.ofp
Program: Msm DownloadTool v2.0.72 +++ XLoader-Realme +++ Qualcomm Driver

Files: https://mega.nz/folder/0k5E0IIJ#Y1mBk2vNEMt7DcLo9SO68Q

 

[Renate]

He installed the 9008 driver and when he was done, he DELETED the driver.

Huh? I thought that the stupid virtual Com port drivers were just an obtuse way to turn perfectly usable USB bulk endpoints into a com port for applications and people who are stuck in the 1990's.

I use EDL a whole bunch. I just connect directly to the USB interface using WinUSB. Ok, everything in Windows needs a driver and for WinUSB I use the generic Zadig driver installer. Both the Python EDL client and my own can connect just fine without a com port.

If the problem is that you have to use a com port because the tools you have only work with them then it would be a good idea to snoop the USB to see what undocumented/unknown thing it is doing so that they may be implemented on non-com port EDL clients.

 

[PlasmaTornado]

I feel like we're slowly coming closer to get past this issue! Once we have MSM tools, we can finally have true development and security for our devices

 

[beatbreakee]

if i arrange remote season is there anyway to note PW? i mean if he copy paste
then which is the best way to capture this PW? after i think i can share pw with beatbreakee

running a personal proxy server, and a packet capture app like Fiddler, pr Winpcap. You wont necessarily get the actual USERID and PW.... but instead you will get the authentication tokens. But thats only for extreme circumstances like where they paste their info. In more common cases just attatch a keylogger to your os.