moto-penangf
Preloader updated? #3
Replies: 12 comments 148 replies
-
|
DA_PL_NO_CERT_V6 seems to be the default DA file right after the release of the phone. MT6768_USER.bin creation dates 4 days before DA_PL_NO_CERT_V6. |
Beta Was this translation helpful? Give feedback.
-
|
So basically for penangf they just threw what worked without even caring enough to give the ability to format, that says a lot |
Beta Was this translation helpful? Give feedback.
-
Same difference in scatter files with G13, but for some reason it didn't ask...
So, how we wipe the whole thing? Or is preloader enough? |
Beta Was this translation helpful? Give feedback.
-
|
For wiping we should be able to use either meta mode or recovery as found in the thread about adb sideload |
Beta Was this translation helpful? Give feedback.
-
I have seen wipe in these different SPFT config files. Depends maybe the firmware, tool, etc. is it usable... With G23 RSA acts the same... Naturally. Same tool and the same firmware. |
Beta Was this translation helpful? Give feedback.
-
Our DA himself seems to forbid it |
Beta Was this translation helpful? Give feedback.
-
Yes, preloader changed every update (at least version) and that's why we get ANTI_ROLLBACK. Also DA file was changed at least once, because if you use some DA from lolinet - you get ANTI_ROLLACK error in mtkclient |
Beta Was this translation helpful? Give feedback.
-
|
Looks like our preloader was compiled with the ability to do this since we get the "emergency download mode" error!! What worries me is the timeout of 5 seconds 🤔 Note I found an older chipset preloader src, but I assume it would still apply somehow. I can't read the preloader decompilation, I don't know asm that much, but surely if we could get an hint on how this function works in our preloader, we might understand better. |
Beta Was this translation helpful? Give feedback.
-
We should avoid updatingin case they patch stuff in the preloader or efuses for loading brom. Our best candidates to boot brom are KPCOL0 if they didn't patch preloader to disable the TP or short CLK. KPCOL0 could get patched, CLK should work in any case (because we make impossible to read the eMMC) |
Beta Was this translation helpful? Give feedback.
-
We still don't know exactly what KPCOL0 gives us... I can't help you yet because of the damn battery. |
Beta Was this translation helpful? Give feedback.
-
I know, but we have time for sure so no rush, just be sure not to update and download the current firmware to be sure. I'm trying to get bypass_utility to work because I want to try something, but the version on the aur is using LTS kernel and not the latest 6.12, and the precompiled aur doesn't work so i'm compiling the kernel with kamakiri patch. FireISO didn't work for me |
Beta Was this translation helpful? Give feedback.
-
|
What I want to do is try to crash preloader with mtkclient, and in the 5 seconds time frame try to run mtk bypass. Would have been easier if mtkclient decided to work under windows correctly |
Beta Was this translation helpful? Give feedback.
-
Yeah! Running mtkclient on Windows is a pain... |
Beta Was this translation helpful? Give feedback.
-
Kind of hack for LG stylo 6 etc. SP flash tool and mtkclient used in the same time on windows to make connection. Later LG removed the brom mode, so downgrading is now needed... |
Beta Was this translation helpful? Give feedback.
-
|
If one looks the files in those older firmware packages (A13), one can find some interesting stuff. For most firmware RSA downloads just a platform tools package instead of SPFT. It should be easily checked which one it uses. (G24's SPFT run normally doesn't show GUI at all. Then again RSA doesn't show SPFT or any other GUI anyway... ) |
Beta Was this translation helpful? Give feedback.
-
I've tried plugging it in a bunch of times with no battery and it boot in Preloader |
Beta Was this translation helpful? Give feedback.
-
|
At least we know now |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 i think that the efuse.tmp file is some sort of file to tell sp flash tool what to do, like the scatter file. |
Beta Was this translation helpful? Give feedback.
-
|
Those tmp files are like that download.xml file in that bat file's example. If run from a command line. IDK what xml files are loaded as default in GUI mode, if any. From flash tool's usb_settings.xml one can find those ports... |
Beta Was this translation helpful? Give feedback.
-
Does this mean we have no luck reading efuses? |
Beta Was this translation helpful? Give feedback.
-
|
I think they disabled BROM by efuse: Found in lk.img |
Beta Was this translation helpful? Give feedback.
-
26 upper case letters + 10 numbers and length is 20 = 36^20 = 1.3367495e+31 ??? |
Beta Was this translation helpful? Give feedback.
-
Oops, I messed up my calculations, but yeah even worse |
Beta Was this translation helpful? Give feedback.
-
that commands just gathers some data from the phone! We can manually recreate the data needed |
Beta Was this translation helpful? Give feedback.
-
|
But this still wouln't be useful, as we still wouldn't get the key from the website, not even device with unlock_data have a lucky time getting the eligible popup. In my opinion, most of the data in the "unlock_data" is useless, just needed for confirmation and masking of what they actually need to give you the correct key. Our device also uses mtk default bootloader, so the process might be even different from what the official moto bootloader does |
Beta Was this translation helpful? Give feedback.
-
|
Guess what? This efuse warning appears since the first lk of android 13, so at least we know it wasn't patched after, but they disabled it on production directly, so not even phones with android 13 could be a chance |
Beta Was this translation helpful? Give feedback.
-
|
@shomykohai I can't figure out what this command does? |
Beta Was this translation helpful? Give feedback.
-
[466424] [fastboot
(bootloader) ]-[download_base:0x4
(bootloader) e000000]-[download_s
(bootloader) ize:0x0]
[466424] [
(bootloader) Cmd process]-[buf:oe
(bootloader) m printk-ratelimit]-
(bootloader) [lenBuf:]
[SEC_USBD
(bootloader) L] 0x22, SC
[466424
(bootloader) ] UNKNOWN ARGUMENT
(bootloader) [SEC_USBDL] 0x22, SC
(bootloader)
[542130] [fastboot
(bootloader) : command buf]-[oem
(bootloader) printk-ratelimit]-[l
(bootloader) en=20]
[542130] [fa
(bootloader) stboot]-[download_ba
OKAY [ 0.244s] |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
I think it rates limit how much stuff can be printed by the kernel |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 do you have any idea how tools like AMT claim to unlock bootloader or remove frp on our device? I saw AMT has bootloader unlock for g13 but not g23, but we know it's not an issue. We know that we don't have write access to frp in our device with mtkclient, and during the process AMT logs "patching security data" Could it be that our device has a sort of hidden SLA enabled? I thought, what if we analyze RSA requests with Wireshark to see? We know RSA is capable of upgrading firmware, included parts that we can't flash like preloader and lk. Considering that with mtkclient we can't write even official firmware binaries to protected partitions, how does RSA/SPFT even do it?? You see the problem here? Official software can flash the same contents we can't flash with mtkclient |
Beta Was this translation helpful? Give feedback.
-
I guess we're back to finding either how to enter brom or generate the unlock key for fastboot |
Beta Was this translation helpful? Give feedback.
-
That config file (efuse.tmp) has some keys etc. probably needed. Have you tried it from the command line? |
Beta Was this translation helpful? Give feedback.
-
efuse.xml.txt |
Beta Was this translation helpful? Give feedback.
-
I don't think that would work, I'll try, but anyway, there's something curious here! |
Beta Was this translation helpful? Give feedback.
-
|
Anyway, doesn't work, I can't read efuses |
Beta Was this translation helpful? Give feedback.
-
|
Hmm... Many times just DA_PL_NO_CERT_V6 is shared for these tools. Sometimes with a firmware(?) preloader. Now just a preloader... |
Beta Was this translation helpful? Give feedback.
-
|
I can't see the attached image unfortunately, but yeah brom for us needs a combination of volume buttons, problem is that one of these is a test point 😅 You're right about which DA they share, but it must be something behind these tools too, they can write to frp, we cannot |
Beta Was this translation helpful? Give feedback.
-
|
https://mega.nz/file/14MwjChR#o6Q8oGCfyxiF8hy460ZoEgb4LVMjmPM91gVkZeIqVDA |
Beta Was this translation helpful? Give feedback.
-
They share this preloader with moto g23 FRP??? |
Beta Was this translation helpful? Give feedback.
-
|
Typo in the title, okay, but in the tag too... ?? Well, there is a lot of info out there, some ok, some not so... |
Beta Was this translation helpful? Give feedback.
-
|
I don't understand what typo you're referring to Anyway, those testpoints you sent are pretty hard to use, they are in the back of the motherboard under the shields, no wonder nobody tested them. Though, they are indeed possible testpoints. |
Beta Was this translation helpful? Give feedback.
-
Like if the poster meant it for G22... |
Beta Was this translation helpful? Give feedback.
-
|
Oh okay, I get it now, I thought you were talking about something else because you made another post instead of replying to the old one, my bad |
Beta Was this translation helpful? Give feedback.
-
|
so, actually my bad... lol. |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 Our preloader doesn't have this function
|
Beta Was this translation helpful? Give feedback.
-
|
Interesting enough, this is the code that sets the device to reboot to BROM: // This comes from penangf preloader
void platform_safe_mode(int en, u32 timeout)
{
U32 usbdlreg = 0;
timeout = !timeout ? 0x0000FFFC : timeout / 1000;
timeout = (timeout & 0x3fff) << 2
usbdlreg |= timeout;
if(en)
{
usbdlreg | 1;
}
usbdlreg &= ~USBDL_BIT_EN;
DRV_WriteReg32(MISC_LOCK_KEY,MISC_LOCK_KEY_MAGIC); // MAGIC
DRV_SetReg32(RST_CON,1);
DRV_WriteReg32(MISC_LOCK_KEY,0);
// DAT_0002b6ec = uVar3 | 0x444c0000
DRV_WriteReg32(USBDL_FLAG,usbdlreg | 0x444C0000);
}Here's a source code for comparison usbdlreg &= ~USBDL_BROM ;Assuming the presence of compiler optimizations, this condition would only get removed if the value stayed the same, and in this case it would if #define USBDL_BROM (0x00000002) /* 0: usbdl by brom; 1: usbdl by bootloader */What do you think @progzone122? |
Beta Was this translation helpful? Give feedback.
-
|
And this is called when there's an error in the preloader:
So we know that the first parameter is 1, and we know from the logs that timeout is 5000 |
Beta Was this translation helpful? Give feedback.
-
|
Also, in our preloader, it should enter emergency download mode right away... |
Beta Was this translation helpful? Give feedback.
-
|
Basically our preloader hints everywhere that BROM is accessible for our device, but we can't get it for some reason |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 I found this source code that apparently made it possible to unlock a bootloader of an Amazon device while looking up for preloader exploit: Do you think we could make something similar? To disable DA verification |
Beta Was this translation helpful? Give feedback.
-
Oh, perfect timing then to find out about this person! Let's hope he can help us then!! I found the Repository while looking on some sources on preloader exploit, and it looked exactly like the same problem we had, with no access to brom. I was planning on doing my tests with this, but if we can get him to help us as you said, I'll wait. |
Beta Was this translation helpful? Give feedback.
-
|
Anyway, just because I don't wanna open an issue for something this quick, I pushed some small updates to the documentation the other day but they didn't make it to prod. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
Maybe we'll still have a chance... |
Beta Was this translation helpful? Give feedback.
-
Do you think we can reverse the OEM algorithm? We already have an Idea of what it does, but we don't know what kind of hashing and buffer copying it does. |
Beta Was this translation helpful? Give feedback.
-
Downloading firmware for penangf Android 13, I compared the preloader file with the new one.
It looks like the two file differ.
Could this be the reason we get DA Anti Rollback when using old DA file included in firmware?
Did the preloader got patched after release date? Or does the preloader changes based on different retail channels?
This would also explain the DA file changing from MT6768_USER.bin to DA_PL_NO_CERT_V6.bin
Old preloader: https://mirrors.lolinet.com/firmware/lenomola/2023/penangf/official/RETAIL/penangf_g_user_13_THA33.31-26_release-keys.zip
Flash Tool with all DAs: https://mirrors.lolinet.com/firmware/lenomola/2023/penangf/flashtool/SP_Flash_Tool_Penang4G_V6.zip
Beta Was this translation helpful? Give feedback.
All reactions