ZTE Axon M research

[ZeroTheSavior]

I decided to do some digging since I just purchased one of these devices.

fastboot binary is emmc_appsboot.mbn from an update zip.

fastboot oem commands in the CN ROM: unlock, unlock-go, lock, device-info, enable-charger-screen, disable-charger-screen, off-mode-charge, select-display-panel, run-tests

fastboot oem commands in the US ROM: unlock, unlock-go, lock, device-info. US rom is older, which is probably why some commands are missing.

You may be able to find more using a disassembler or with abootool https://github.com/alephsecurity/abootool

First step to getting more research done would probably be to get EDL working for the US variant. Or someone seeing what "unlock-go" does (probably nothing).

After getting EDL working, getting Firehorse functional would be beneficial. However I don't know how the rawprogram.xml is generated. I believe it has to be generated using the partition table somehow, but I do not know how to find the partition table.

I don't know how the bootloader images are signed, but my guess is that flashing CN over US will just leave your phone permanently bricked if they are signed differently. Downgrading the bootloader will also not work if qfuses are implemented correctly (although sometimes they aren't). Checking 16C7 in emmc_appsboot.mbn, US bootloader has the same string across versions and CN has a different one so I'm guessing they are in fact signed differently.

 

[ugynok]

Hello! I have US variant and EDL is working, you can type in adb: reboot edl

 

[ZeroTheSavior]

So I didn't find out "adb reboot fastboot" doesn't work until now.
Since EDL can read/write partitions, it might be possible to
1. Unlock the bootloader by dumping devinfo, writing unlock bit, then writing it back to the device
2. Upload a su binary to the system partition after the bootloader has been unlocked. (It's not that simple these days, unfortunately)

Additionally there is a flag in build.prop that seems to enable download mode but in reality it does nothing at all. the prop is "persist.sys.dlctrl" with setting of 1. But maybe it's for development devices only.

Unsurprisingly, Factory Test Mode does not give you a root shell. It's the same privilege level as normal boot.

Using the firehose elf from the TWRP thread, I was able to dump the devinfo partition, but the partition is all zeroes. I'm not sure what's missing.

 

[LittleBlackDuck]

Recently discovered zero-day exploit in Android could possibly help us with an alternative way to achieve root? Anyone with the skills to use this knowledge to get us "no bootloader" owners any closer to our goal?

https://www.helpnetsecurity.com/2019/10/17/android-root-cve-2019-2215/

 

[Unjustified Dev]

So I didn't find out "adb reboot fastboot" doesn't work until now.
Since EDL can read/write partitions, it might be possible to
1. Unlock the bootloader by dumping devinfo, writing unlock bit, then writing it back to the device
2. Upload a su binary to the system partition after the bootloader has been unlocked. (It's not that simple these days, unfortunately)

Additionally there is a flag in build.prop that seems to enable download mode but in reality it does nothing at all. the prop is "persist.sys.dlctrl" with setting of 1. But maybe it's for development devices only.

Unsurprisingly, Factory Test Mode does not give you a root shell. It's the same privilege level as normal boot.

Using the firehose elf from the TWRP thread, I was able to dump the devinfo partition, but the partition is all zeroes. I'm not sure what's missing.

It doesn't use devinfo to store bootloader bit it's stored in the rpm partition and cannot be modified. As you can see the bootloader does not have to be unlocked to boot non zte signed images, but if it could be unlocked we would be able to run newer devices firmware. Zte played it smart and signed every variant different so aboot from a another variant will brick you.

Sent from my ZTE A2020U Pro using Tapatalk

 

[ZeroTheSavior]

I see.
Unfortunately I think most of this is beyond my ability and knowledge, this is my first time trying to "exploit" a device (if you can honestly call it that, I don't even know what I'm doing half the time).

But since bootloader does not need to be unlocked to run unsigned images, is it possible to run a custom kernel?

 

[Unjustified Dev]

I see.
Unfortunately I think most of this is beyond my ability and knowledge, this is my first time trying to "exploit" a device (if you can honestly call it that, I don't even know what I'm doing half the time).

But since bootloader does not need to be unlocked to run unsigned images, is it possible to run a custom kernel?

Yes, I ported Lineage to the device. But trying to modify stock and change the kernel or flash magisk I had no luck. Not sure what the f**k ,is all I can say is, stopping it. I'm doing a lot of security studying and programming I'm sure I'll figure it out sooner or later my goal is to get a custom lk running with fastboot and run oem unlock then switch to CN updated firmware.

Sent from my ZTE A2020U Pro using Tapatalk