Research on unlocking. Help wanted: root before unlocking bootloader? - Xiaomi Poco F1 Questions & Answers

Hi, I would like to see what the bootloader unlock does exactly do to the raw flash storage. Older phones can be fully unlocked that way, without official permission. Obviously, I need to read out the raw partitions before and after unlocking. The easiest way is to get root and backup from MIUI.
Does anybody know how to root the stock MIUI without unlocking the bootloader? Re-locking does not count.
Does a bootloader-locked, unrooted, stock MIUI let you downgrade? An older ROM might have security bugs that let you root it.
Known pieces of the puzzle, if going the root route:
* Earlier Xiaomi devices let you unlock the bootloader by writing to the devinfo partition. Both the Redmi Note 3 (kenzo) and Redmi Note 4 (mido) still have the bits set at 0x10 and 0x18 as described in the link. But Xiaomi changed things starting with the Redmi Note 5 (whyred) - it has a bit set at 0x90 in an otherwise conspiciously empty devinfo partition.
* The Sony Xperia XZ1 compact can be rooted without unlocking. For that phone, it's motived by DRM.
* How to take complete control of pre-2016 phones. Today, this can serve as a tutorial. Beyond my abilities.
The second way would be to read out (and write to) the phone in EDL mode, or memory debug mode, ...., before and after unlocking the bootloader. Known pieces of the puzzle:
* Zeroing out the abl_a and abl_b partitions might grant read/write access to the raw flash as a mass storage device. This is memory debug mode, similar to EDL. If it doesn't work, you will need EDL to recover because you zeroed out fastboot.
* A list of points of attack on EDL authentication. Once you can bypass EDL authentication, it lets you read and write to raw flash. However, a direct attack on EDL authentication is beyond my abilites.
* Enter EDL mode with test point method or by grounding one of the pins next to the SystemOnChip.
Does anybody know how to bypass EDL authentication?
Does anybody know how to enter memory debug mode without root?
The third way would be to decompile the bootloader chain and see how each piece checks bootloader lock status. However, this is the least useful and probably least fun method. Known pieces of the puzzle:
* Description of the Snapdragon 845 boot process (older but more complete overview)
* Unlock status is checked both by the primary bootloader and the Android bootloader. The primary bootloader lives somewhere in memory and will let you into EDL if the bootloader is unlocked and you rebooted with "fastboot oem edl" etc. The Android bootloader image is the abl.elf file in the official update downloads. It will let you flash (or honor "fastboot oem edl") if it is unlocked.
* Memory debug mode is accessed through the XBL bootloader, i.e. the xbl.img and xbl_config.img files in the official update downloads.
If you found this thread trying to unbrick your phone, you need to go here instead.

Related

Is there a way to flash ROM without unlocking Pocophone F1?

Hello Sirs/Ma'am,
Is there a way to flash Pocophone F1 without unlocking bootloader? My phone's update was interrupted and sent to Xiaomi Service Centers but they said it was hopeless unless they change it's motherboard.
My phone is now in bootloop and shows only whitescreen, I can only access the boot options (accessible by keys)
Tried flashing it but all tutorials I encounter requires me to unlock the bootloader. Tried unlocking it but I get the error "Current account is not bound to this device", I tried every account I had but It all didn't work.
check this video (especially at 01:10)
https://www.youtube.com/watch?v=g3J78IqbWzM
chazy chaz said:
check this video (especially at 01:10)
https://www.youtube.com/watch?v=g3J78IqbWzM
Click to expand...
Click to collapse
Hi Im sorry forgot to mention my phone was in Bootloop Updated the thread
I think there is no other way to flash poco f1 without unlocking the bootloader. if you are flashing different ROM. but if not. try the flashing guide of using MiFlash tool there is instruction on how to flash using MiFlash.
back in old days by entrying in to EDL (redmi3s) you could replace boot.img (stock) with boot.img (twrp) in the extract .tgz file (3gb)
redmi3s goes to edl by pressing all 3 buttons 30 seconds
once you have twrp on locked bootloader you could flash other roms! since stock recovery is replaced
however later they made edl hard by short circuit test point method where back cover must be removed and two certain points to be touched by wire of motherboard and connecting usb wire to pc SIMULTAINEOUSLY
this method is valid till now! if you remove poco back panel it can go in to edl
but now flashing EDL requires AUTHORIZED account in Xiaomi flasher so its not possible anymore!
But this tool requires that ADB is enabled in developer options... If the phone is completely bricked or screen cracked... There is no way for me to enable it.
This is the reason I made this post.

Unlocking Bootloader & Root On LG K40

Having trouble rooting my LG K40. I have the same problem as this person when trying to boot into fastmode: https:// youtu.be/yQ99lQv0rQk?t=26
You can find his post here explaining the process more in detail: https:// lgk20.com/root-lg-k40-lm-x420-bootloader-unlock-twrp/
MODEL #: LM-X420MM
Any help is appreciated,
Thanks in advance.
im having the same problem. i must have a proclivity towards phones with what seems impossible rooting methods. the first was the samsung j7 prime and now the lg k40 lmx420mm. ive gotten as for as adb reboot-bootloader, just restarts device, fastboot commands are either not recognized or i receive "waiting on device". Ive updated drivers, followed a diff. method found on reddit posted by jamesrascal (i cant post url here because of my newb status). Phone just stays stuck in firmware update. i feel as if ive exhausted all resources, any direction or help would be appreciated, im not educated on rooting ive been successful a few times on other phones and jailbroken some iphones, im mostly doing this to learn and teach myself so it isnt urgent but i need help to continue any further. thank you
Same problem for me. Because the device has good value for the money it would be nice someone can help us here.
Further this device seems to be full android treble conform I like to know how benefit from this circomstance.
I have LG K40 LM-X420EMW with dualsim.
Thanks for every hint!
@blanksus
IIRC an Android user can not unlock the bootloader without first OEM unlocking, because without this process the device will not accept the bootloader unlocking command.
jwoegerbauer said:
@blanksus
IIRC an Android user can not unlock the bootloader without first OEM unlocking, because without this process the device will not accept the bootloader unlocking command.
Click to expand...
Click to collapse
OK, but it is not possible to get into fastboot mode to enable the OEM unlocking. I marked the slider in developer option butz still there is no chance to get in fastboot mode.
After command "adb reboot bootloader" the device always reboots in normal system mode.
@baerenbisch
Once you enabled the OEM unlock on your Android, the “unlock ability” flag is set to 1, which allows you to use the
Code:
fastboot flashing unlock
command what unlocks device's bootloader.
BTW: Once you have enabled OEM unlock, it stays on. Even if you do a factory reset, it stays unlocked until the setting is manually altered again by going into the Developer options section.
jwoegerbauer said:
@baerenbisch
Once you enabled the OEM unlock on your Android, the “unlock ability” flag is set to 1, which allows you to use the
Code:
fastboot flashing unlock
command what unlocks device's bootloader.
BTW: Once you have enabled OEM unlock, it stays on. Even if you do a factory reset, it stays unlocked until the setting is manually altered again by going into the Developer options section.
Click to expand...
Click to collapse
Hm,
may be it is "allowed" to unlock but in the "LG K40 (LM-X420EMW) real world" it is not possible.
You dont reach fastboot mode which could enable using the order you proposed.
Device reboots into standard mode instead of wanted fastboot mode after sending "adb reboot bootloader"
I think thats the problem.
Code:
[email protected]:/# adb devices
List of devices attached
LMX4205P4TU4S4HEOJ device
[email protected]:/# adb reboot bootloader
[email protected]:/# fastboot flashing unlock
< waiting for any device >
^C
[email protected]:/#
OK, good news. One can get root with this method:
https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
Works for LG K40 (LM-X420EMW) Android 9 Kernel 4.9.117 Patch Level January 1, 2020 Build Nr. PKQ1.190522.001 Software-Vers. V20d-EEA-XX
baerenbisch said:
OK, good news. One can get root with this method:
https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
Works for LG K40 (LM-X420EMW) Android 9 Kernel 4.9.117 Patch Level January 1, 2020 Build Nr. PKQ1.190522.001 Software-Vers. V20d-EEA-XX
Click to expand...
Click to collapse
Temp root does sound nice, but what can you actually do with it. Can you change the OEM unlock key?
roycrt said:
Temp root does sound nice, but what can you actually do with it. Can you change the OEM unlock key?
Click to expand...
Click to collapse
Device can be bootloader unlocked now. MtkClient on github. I have the Harmony 3 bl unlocked and twrp for it
Can confirm, I was just able to unlock the bootloader with mtkclient and root with Magisk from there.
BenTheTechGuy said:
Can confirm, I was just able to unlock the bootloader with mtkclient and root with Magisk from there.
Click to expand...
Click to collapse
Please elaborate steps taken to unlock bootloader using mtkclient. Thanks
I wrote a guide as part of my porting of postmarketOS to my K40.
LG K40 (lg-mmh4x) - postmarketOS
wiki.postmarketos.org

How could I root my device? (Samsung Galaxy A01) (Well explained)

Hi! My name is Bautista.
This is my first post well explained, I already asked this question before but I did not express myself well (I hope to do it correctly in this attempt)
My problem happens with my Samsung Galaxy A01 SM-A015M, Running on OneUI 2.0/Android 10 with 2gb of ram, a Snapdragon 439, the stock rom/firmware and 32GB of storage, from Argentina.
Things I tried so far, and didn't work for me:
Unlocking the bootloader by following the Gearallnews and Cyanogenmods guides to the letter.
When trying to unlock the bootloader with the guides on the aforementioned pages, when starting the device a sign should appear saying that the bootloader is unlocked, which did not appear.
The device started correctly in the process to configure the device the first time it is turned on, connect the wifi as the guides said. Followed by that I went to the developer options and the option "Oem unlock" was still activated and in blue (which should not happen, it should appear grayed) I heard that some Samsung devices with snapdragon processors had a bootloader that cannot be unlocked
Unlocking the bootloader using ADB AND Fastboot. (ADB detects my device fine, but fastboot doesn't detect it at all)
Using Fastboot from Windows 7, Windows 10, and Kali Linux.
Installing TWRP.
Use rooting apps. (the ones that appear on the XDA rooting page)
What I am going to with this thread, is:
Can my device's bootloader be unlocked? And if so, how?
If the bootloader cannot be unlocked, how can I root or install TWRP?
Please, if you don't understand something or need more information, let me know by replying to this thread or sending me a private message.
Look inside here.
jwoegerbauer said:
Look inside here.
Click to expand...
Click to collapse
it's the same as Gearallnews and Cyanogenmods guides, i already did that, it dont work
Like the original poster I also have a Samsung Galaxy A01 SM-A015M/DS, OneUI 2.0/Android 10, 2GB ram, 32GB storage, Snapdragon 439, stock firmware (TPA) Panama. I have gone through all the aforementioned procedure and the bootloader does not unlock. There is no bootloader unlock warning on reboot and the OEM Unlock in developer option does not grey out. Does the Snapdragon processor not allow bootloader unlock or is anyone aware of a solution. Thanks for any assistance.
@mullerh
If in Settings -> Developer Option the option "OEM unlock" is present then unlocking the bootloader obviously isn't denied by OEM/Carrier.
But you can check it at your own:
Code:
adb devices
adb shell "getprop ro.oem_unlock_supported"
jwoegerbauer said:
@mullerh
If in Settings -> Developer Option the option "OEM unlock" is present then unlocking the bootloader obviously isn't denied by OEM/Carrier.
But you can check it at your own:
Code:
adb devices
adb shell "getprop ro.oem_unlock_supported"
Click to expand...
Click to collapse
Thanks for your response and assistance. The command:
adb shell "getprop ro.oem_unlock_supported" returns a 1
I googled it but found no clarification but I assume that means it is supported.
Therfore there is something else that is blocking the bootloader from unlocking from the unlock mode screen and just prior to reset.
There is also no unlock bootloader warning during the reset.
The more I have Googled this problem the more it seems to indicate that many newer Samsung phones released in North/Latin America with Qualicom Snapdragon 439 processors, have the the bootloaders locked down with a new "security" feature called SecureBoot. Would be interested in getting the experience of others. Thanks
mullerh said:
Thanks for your response and assistance. The command:
adb shell "getprop ro.oem_unlock_supported" returns a 1
I googled it but found no clarification but I assume that means it is supported.
Therfore there is something else that is blocking the bootloader from unlocking from the unlock mode screen and just prior to reset.
There is also no unlock bootloader warning during the reset.
The more I have Googled this problem the more it seems to indicate that many newer Samsung phones released in North/Latin America with Qualicom Snapdragon 439 processors, have the the bootloaders locked down with a new "security" feature called SecureBoot. Would be interested in getting the experience of others. Thanks
Click to expand...
Click to collapse
Hi! Did you manage to find a way to unlock the bootloader?
I have not been able to unlock the bootloader on this SM-A015M/DS (Latin American) model with Snapdragon processor. I have done a lot of searching but found little info except articles stating Samsung had gone through some extra effort to secure their latest phones. That also means I can not root it. I was hoping to get some feedback from other who may have had a better experience,
have you tried using the twrp app to install twrp?
i had an old galaxy grand prime which was impossible to unlock, but the app worked without issues
the only thing i had to pay attention is to turn it off right before ir reboots after installing and then loading into recovery
letting the mobile startup without doing this overrieded the command to install twrp
Thanks for your response. It is my understanding (I could be wrong) that before TWRP can be installed the Bootloader needs to be unlocked. The older Samsung usually allowed the Bootloader to be unlocked even if there was difficulty in rooting them. It appears that some of the newer Samsung's with the Snapdragon processors have added an additional security feature called SecureBoot which blocks the Bootloader from being unlocked.
Does anyone have a definitive answer for how to turn the bootloader on? I recently purchased a SM-A015M/DS and didn't have issues with the OEM bootloader option appearing in the options. But when I enter fastboot mode it says my device status is locked. I can't work out if that means it's locked or not.
For what it's worth, when I flashed the firmware onto the phone in the first place, I had to enable the developer option manually- I did this by booting into download mode and then a long press on the volume up button when prompted by the menu. I don't see why this wouldn't work for other devices. There are youtube videos that explain in greater detail if you haven't tried this yet.
Newiser7 said:
Does anyone have a definitive answer for how to turn the bootloader on? I recently purchased a SM-A015M/DS and didn't have issues with the OEM bootloader option appearing in the options. But when I enter fastboot mode it says my device status is locked. I can't work out if that means it's locked or not.
Click to expand...
Click to collapse
Enabling OEM unlock option in Developer options does NOT UNLOCK the bootloader. Once you enable the OEM unlock on your device, the unlock ability flag is set to 1, which will allow users to use the fastboot flashing unlock command, the command what starts the "unlocking the bootloader" procedure.
FYI:
After the command is executed, you will see an option for bootloader unlock on your device’s screen.
Use the volume buttons to move up and down and select the option to unlock the bootloader.
A prompt will pop up, asking for confirmation. Use the power button to confirm your selection as yes, and you are done.
The phone will now reboot to fastboot mode. Enter the command “fastboot reboot,” and it will boot into PC.
jwoegerbauer said:
Enabling OEM unlock option in Developer options does NOT UNLOCK the bootloader. Once you enable the OEM unlock on your device, the unlock ability flag is set to 1, which will allow users to use the fastboot flashing unlock command, the command what starts the "unlocking the bootloader" procedure.
FYI:
After the command is executed, you will see an option for bootloader unlock on your device’s screen.
Use the volume buttons to move up and down and select the option to unlock the bootloader.
A prompt will pop up, asking for confirmation. Use the power button to confirm your selection as yes, and you are done.
The phone will now reboot to fastboot mode. Enter the command “fastboot reboot,” and it will boot into PC.
Click to expand...
Click to collapse
FYI:
Samsung devices do not support fastboot command, you use Odin or Heimdall to flash what you need.
The answer you provide is misleading
mullerh said:
FYI:
Samsung devices do not support fastboot command, you use Odin or Heimdall to flash what you need.
The answer you provide is misleading
Click to expand...
Click to collapse
You are right: I was mistaken.
Thank you for clarifying that the bootloader is still locked. But how can I unlock it? Odin will let me flash the files, but I keep getting AUTH errors when I try to flash magisk patched files to root the phone. I'm assuming this is because the bootloader preventing the files from transferring. Is there a way to unlock it using ADB without fastboot, or a way using Odin? It seems crazy that unlocking the bootloader is enabled but I am still unable to actually unlock it.
I have also tried the CROM Service app (couldn't get it to install on my phone, error 3003 with ADB install), as well as the bootloader unlock method where I boot into download mode, hold the volume up key, and unlock the bootloader that way. I have done the latter at least 5 times and the bootloader is still locked. Ridiculous.
This prop apparently only confirms that the phone supports being unlocked, not that it is actually unlocked.
adb shell "getprop ro.oem_unlock_supported"
Check a few others, also see the official docs.
sys.oem_unlock_allowed
androidboot.flash.locked (the docs say this, but I think Samsung uses something different)
ro.boot.flash.locked
ro.boot.other.locked
Maybe also check these:
ro.boot.verifiedbootstate
ro.boot.veritymode
The docs indicate that the verifiedbootstate should be orange if the bootloader is unlocked. I don't know much about it, though.
You can always use grep to search for any interesting values, like "lock" or "boot" or "flash":
adb shell getprop | grep lock
adb shell getprop | grep boot
adb shell getprop | grep flash
Maybe report any interesting values you have with and without OEM Unlock checked. Maybe someone smarter than us will find it useful.
I would really like to see an A01 root happen, it's such an affordable and accessible device for all sorts of things. Great as a backup device or for a project. You think someone would've released some goods for it by now. It's been out all year.
And for the 16GB model, it's absolutely terrible because Samsung eats up so much space, then has the nerve to remove the Adoptable Storage feature. So even if you get a fast SD card, you can't install apps on it. Other than that, it's a perfectly serviceable phone. I would think with root we could get Adoptable Storage working.
To summarize what has been previously stated the Samsung Galaxy A01, version SM-A015M/DS is the Latin American version of this cellphone. This cellphone has a Snapdragon processor. This version is very similar to the versions (also Snapdragon processors) used by some US Carriers. Many current versions of Samsung cellphones have an additional security feature called "SecureBoot" which blocks bootloader unlocking. Some say this features was added at the request of US Carriers
The Asian version of the A01 has a Exynos processor. It is my understanding that with these it is very easy to unlock the bootloader and root the phone using the usual conventional methods. The Asian variant unfortunately does not cover some of the wireless bands used in the US/Canada/Latin America.
I have a Samsung Galaxy A01 SM-A015M/DS, OneUI 2.0/Android 10, 2GB ram, 32GB storage, Snapdragon 439, stock firmware (TPA) for Panama.
My research indicates that there is not yet an available bootloader unlocking and easy root method for this (A01) phone. For some other current Samsung models there does appear to be a method of flashing certain custom ROMs without a bootloader unlock but they appear to come with problems which include loss of some cellphone functions and a reduction in the charged battery life. So it seems hardly worth it.
It also appears that it is current well known that all current Samsung phones with Snapdragon processors have not allowed bootloader unlocking and rooting due to the enhanced security feature.
At this time we can only complain and/or not buy any additional Samsung phones
Perhaps with time skillful developers will come up with a method to solve this problem with this inexpensive A01.
Please provide any new or updated info if you have it.
Any solution for rooting Galaxy A01 ?
I use A015f region SER (Russia) In Russia, too, the device is locked (bootloader) of course, give any solution
One thing I know is that a fellow SM-M015f, which is almost identical, which is with the same Snapdragon 439, except for the battery capacity and screen size and gigabytes of internal memory, successfully unlocks and gets Magisk root.
this phone actually has a fastboot mode, from recover mode select reboot to bootloader, it will boot to fastboot mode,but ive still been unsucessful in getting fastboot mode to work, devices manager reports device error,
I can start the unlock proccess.
But after it is done and the data is wipped,
It keeps locked.
Sad

Broken Google Play Certification / CTS Profile on 00EEA in Android 11

Hello,
I had this phone as a backup one laying around, and when my present phone died two weeks ago, I have updated the system and unfortunately found out the hard way that I lost all payment cards in Google Pay. The 00EEA variant is not "Google Play Certified" at least from 3.150 (and its variants) and the CTS profile match fails. Adding the ID did not help, nor reporting the issue. I hoped that the new firmware 3.240 will fix the issue, but it did not. The bootloader has been locked and everything seemed OK:
Code:
Device info
Device tampered: false
Device unlocked: false
Device critical unlocked: false
Charger screen enabled: false
I think this problem happened to me in past on Android 9 or 10 as well, and then it has been fixed then, but not this time.
Over last 4 days, I have tried everything including the factory reset, going back to previous slot, even flashing the original 3.150 in EDL mode in one of the slots, to check the problem always persists. During that time I started to be suspicious, as the device fingperprint for newest firmware is Nokia/Panther_00EEA/PAN_sprout:11/RKQ1.200928.002/00EEA_3_240:user/release-keys, but the vbmeta fingerprint is Nokia/Panther_00WW/PAN_sprout:11/RKQ1.200928.002/00WW_3_240:user/release-keys and similar for 3.150 firmware variants.
The WW/EEA variant is stored in oem partition. In the end I found a solution how to fix it on my phone, but it may be dangerous if something goes wrong and it WILL erase user data:
You have to enable developer mode and permit OEM unlocking. Then you have to unlock the phone in fastboot, change the skuid and then you may relock the phone again. The command to check the present skuid:
Bash:
fastboot oem repair skuid get
This will display something like skuid=600EEA (please note the leading 6 which is not displayed)
Bash:
fastboot oem repair skuid set 600WW
will change the skuid to match the one in vmbeta. After new setup/restore of the Backups where posible the device is Google Play certified again.
I am intentionally not giving other commands here needed to reboot to fastboot or to unlock/relock the phone to limit the risks for those not used to such things, but they can be found in other threads here.

General ROM2box - EDL, Scatter, FRP etc... multi-tool

Hello again, just wanted to share something I somehow missed a while ago but feel it would be helpful to many N20 5g users. It's ROM2box and works for FRP unlocking, edl flashing, scatter flashing and many others. This is not mine but I wanted it to be easy to find for the rest of you so here's the link to the thread where it can be found and our device among others is clearly stated as supported.
(Tool) ROM2box All in one FRP, Flashing & unlocking tool
ROM2box is a Powerful tool and GUI bring all the tools on a single app. it support qcom mediatek and spreadtum phones. Supported Functions- Function Name Status bypass Auth Yes bypass FRP MTK yes bypass FRP qcom yes bypass FRP samsung...
forum.xda-developers.com
be very careful with this and for the sake of sanity please make sure you have a full backup of ALL partitions before using rom2box for ANYTHING. i know that if anyone is trying to use it for the frp unlocking it probably means u dont have access to be able to do this in the first place but i suggest only attempting anything without backups if you can accept the risk of completely and possibly permanently bricking the device.

Categories

Resources