Skip to content

Commit 5d4df95

Browse files
committed
add preloader_diff.py info
1 parent a52b248 commit 5d4df95

File tree

1 file changed

+21
-15
lines changed

1 file changed

+21
-15
lines changed

docs/dev/bootloader.md

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ We finally managed to find out the key generation algorithm and you can unlock t
2323

2424
### Bootloader unlock
2525
:::note
26-
You can also use [**this website**](https://html-preview.github.io/?url=https://github.com/cxzstuff/stuff/blob/main/Moto-G23-G13-oem-key2.html) to generate the key instead of using the script if you can't use python.
26+
You can also use [**this website**](https://html-preview.github.io/?url=https://github.com/cxzstuff/stuff/blob/main/Moto-G23-G13-oem-key2.html) to generate the key instead of using the script if you can't use python.
2727

2828
Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
2929
:::
@@ -32,18 +32,24 @@ Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
3232
**IT IS STRONGLY ADVISED FLASHING THE FIRMWARE WITH SP FLASH TOOL BEFORE UNLOCKING THE BOOTLOADER, OR YOU MIGHT RISK AN HARD BRICK IF ANDROID 13 IS STILL PRESENT IN ONE OF YOUR SLOTS**
3333
:::
3434
<iframe width="100%" height="500" src="https://www.youtube-nocookie.com/embed/EGY1_JjN9hU" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
35-
35+
<br/>
36+
<br/>
3637
0. MAKE SURE YOU HAVE THE SAME ANDROID VERSION ON BOTH SLOTS!!<br/>
3738
Otherwise, you might risk hard bricking the phone.<br/>
3839
We suggest flashing stock firmware BEFORE unlocking the bootloader (with SP Flash Tool), to reduce the risks of hardbricking
39-
when switching slots. **DO NOT SKIP THIS STEP**
40+
when switching slots. **DO NOT SKIP THIS STEP**<br/>
41+
42+
:::note
43+
If you have [mtkclient](https://github.com/bkerler/mtkclient) installed, you can compare both preloader slots using the `preloader_diff.py` script from the [fuckyoumoto-utils repository](https://github.com/fuckyoumoto/fuckyoumoto-utils) to guarantee avoiding potential issues without reflashing the device.
44+
:::
45+
<br/>
4046
1. Enable "OEM Unlocking" in developer settings
4147
2. Clone repository [fuckyoumoto-utils](https://github.com/fuckyoumoto/fuckyoumoto-utils)
4248
3. Boot the phone to [fastboot mode](../modes/fastboot.mdx)
4349
4. Get the first part of the soc_id
4450
```shell
4551
$ fastboot oem get_key
46-
52+
4753
(bootloader) 061A757D042B2A378D9761E60C9D3FBC
4854
(bootloader) finish dump
4955
OKAY [ 0.003s]
@@ -52,7 +58,7 @@ Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
5258
5. Run the ```oem_keygen.py``` script to generate the oem key, specifying the received key via the argument
5359
```shell
5460
$ python oem_keygen.py 061A757D042B2A378D9761E60C9D3FBC
55-
61+
5662
To hash: 061A757D042B2A378D9761E60C9D3FBC061A757D042B2A378D9761E60C9D3FBC
5763
Hash: 87f3aef774eb3edbcdef39e2e94d05c98d7fd1b5db8e7623345412390e1db289
5864
Possible keys:
@@ -64,16 +70,16 @@ Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
6470
```
6571
6. Copy the first generated oem key and specify it with the ```fastboot oem key <KEY>``` command and try unlocking the bootloader
6672
````shell
67-
$ fastboot oem key 87f3aef774eb3edbcdef39e2e94d05c9
68-
73+
$ fastboot oem key 87f3aef774eb3edbcdef39e2e94d05c9
74+
6975
(bootloader) open fastboot unlock
7076
OKAY [ 0.000s]
7177
Finished. Total time: 0.000s
7278
````
73-
79+
7480
````shell
7581
$ fastboot flashing unlock
76-
82+
7783
(bootloader) Start unlock flow
7884
(bootloader) 061A757D042B2A378D9761E60C9D3FBC
7985
(bootloader) start fastboot unlock
@@ -87,7 +93,7 @@ Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
8793
7. Checking bootloader unlocking
8894
````shell
8995
$ fastboot oem lks
90-
96+
9197
(bootloader) lks = 0
9298
OKAY [ 0.005s]
9399
Finished. Total time: 0.005s
@@ -100,7 +106,7 @@ Thanks to [**@cxzstuff**](https://github.com/cxzstuff) for making it.
100106
```shell
101107
$ fastboot flash logo logo-5fa2e5b8652ffaebad2bcc6768530fae.bin
102108
```
103-
109+
104110
9. Flash custom bootloader (HIGHLY RECOMMENDED)
105111

106112
[Go to guide](../modding/custom-bootloader.mdx)
@@ -131,7 +137,7 @@ $ fastboot flashing get_unlock_ability
131137
(bootloader) unlock_ability = 16777216
132138
```
133139

134-
In this case the number is equal to 2^24 (24th bit), which seem to either mean **unlockable under certain conditions**, or simply an overflow/bug in fastboot when the bootloader can be unlocked.
140+
In this case the number is equal to 2^24 (24th bit), which seem to either mean **unlockable under certain conditions**, or simply an overflow/bug in fastboot when the bootloader can be unlocked.
135141

136142
The device has a mediatek SoC, so trying with the flashing unlock command:
137143

@@ -151,7 +157,7 @@ The command to install and dump the key was discovered by [DiabloSat](https://gi
151157
In order to specify the key, we need to run the fastboot oem key \<KEY\> command.
152158
:::
153159

154-
#### Dump of the current oem key
160+
#### Dump of the current oem key
155161
Just in case, make a dump of the current oem key
156162

157163
```sh
@@ -210,9 +216,9 @@ FAILED (remote: 'Unlock key code is incorrect!')
210216
fastboot: error: Command failed
211217
```
212218
213-
The first line (which is the key fastboot knoes and has to verify against the second key appearing) is completely empty.
219+
The first line (which is the key fastboot knoes and has to verify against the second key appearing) is completely empty.
214220
215-
Decompiling LK it's clear that it suppose to be filled by the key (which is also the first part of the SoC ID) that has to be stored inside the global variable before everything else.
221+
Decompiling LK it's clear that it suppose to be filled by the key (which is also the first part of the SoC ID) that has to be stored inside the global variable before everything else.
216222

217223
I suspect there's a possibility that fastboot hashes an empty 32 character buffer, and could possibly lead to some exploitation of either the sha256 function or the copy of the hash into a temporary buffer.<br/>
218224
It is confirmed that feeding the first 32 characters of the hash of an empty string as the key doesn't unlock the bootloader.

0 commit comments

Comments
 (0)