You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/dev/bootloader.md
+21-15Lines changed: 21 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ We finally managed to find out the key generation algorithm and you can unlock t
23
23
24
24
### Bootloader unlock
25
25
:::note
26
-
You can also use [**this website**](https://html-preview.github.io/?url=https://github.com/cxzstuff/stuff/blob/main/Moto-G23-G13-oem-key2.html) to generate the key instead of using the script if you can't use python.
26
+
You can also use [**this website**](https://html-preview.github.io/?url=https://github.com/cxzstuff/stuff/blob/main/Moto-G23-G13-oem-key2.html) to generate the key instead of using the script if you can't use python.
27
27
28
28
Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
29
29
:::
@@ -32,18 +32,24 @@ Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
32
32
**IT IS STRONGLY ADVISED FLASHING THE FIRMWARE WITH SP FLASH TOOL BEFORE UNLOCKING THE BOOTLOADER, OR YOU MIGHT RISK AN HARD BRICK IF ANDROID 13 IS STILL PRESENT IN ONE OF YOUR SLOTS**
33
33
:::
34
34
<iframewidth="100%"height="500"src="https://www.youtube-nocookie.com/embed/EGY1_JjN9hU"title="YouTube video player"frameborder="0"allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"referrerpolicy="strict-origin-when-cross-origin"allowfullscreen></iframe>
35
-
35
+
<br/>
36
+
<br/>
36
37
0. MAKE SURE YOU HAVE THE SAME ANDROID VERSION ON BOTH SLOTS!!<br/>
37
38
Otherwise, you might risk hard bricking the phone.<br/>
38
39
We suggest flashing stock firmware BEFORE unlocking the bootloader (with SP Flash Tool), to reduce the risks of hardbricking
39
-
when switching slots. **DO NOT SKIP THIS STEP**
40
+
when switching slots. **DO NOT SKIP THIS STEP**<br/>
41
+
42
+
:::note
43
+
If you have [mtkclient](https://github.com/bkerler/mtkclient) installed, you can compare both preloader slots using the `preloader_diff.py` script from the [fuckyoumoto-utils repository](https://github.com/fuckyoumoto/fuckyoumoto-utils) to guarantee avoiding potential issues without reflashing the device.
In this case the number is equal to 2^24 (24th bit), which seem to either mean **unlockable under certain conditions**, or simply an overflow/bug in fastboot when the bootloader can be unlocked.
140
+
In this case the number is equal to 2^24 (24th bit), which seem to either mean **unlockable under certain conditions**, or simply an overflow/bug in fastboot when the bootloader can be unlocked.
135
141
136
142
The device has a mediatek SoC, so trying with the flashing unlock command:
137
143
@@ -151,7 +157,7 @@ The command to install and dump the key was discovered by [DiabloSat](https://gi
151
157
In order to specify the key, we need to run the fastboot oem key \<KEY\> command.
The first line (which is the key fastboot knoes and has to verify against the second key appearing) is completely empty.
219
+
The first line (which is the key fastboot knoes and has to verify against the second key appearing) is completely empty.
214
220
215
-
Decompiling LK it's clear that it suppose to be filled by the key (which is also the first part of the SoC ID) that has to be stored inside the global variable before everything else.
221
+
Decompiling LK it's clear that it suppose to be filled by the key (which is also the first part of the SoC ID) that has to be stored inside the global variable before everything else.
216
222
217
223
I suspect there's a possibility that fastboot hashes an empty 32 character buffer, and could possibly lead to some exploitation of either the sha256 function or the copy of the hash into a temporary buffer.<br/>
218
224
It is confirmed that feeding the first 32 characters of the hash of an empty string as the key doesn't unlock the bootloader.
0 commit comments