OEM key generation algorithm / Exploit lk #10
Replies: 13 comments 172 replies
-
|
Might want to add that if the bootloader is the same as the public stock ones (or very similar), there's a chance the key has to be reversable to get the serial number. But in that case, the serial number has to be in what format? 🤔 Anyway, I might try to reimplement the code in c later to see how it behaves |
Beta Was this translation helpful? Give feedback.
-
|
Through mtkclient we can find additional data that can participate in key generation SOC_ID is the combined two keys from the fastboot oem get_socid command. |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 I have the impression that moto devices have a fixed size serial number, and thus I was wondering if this is something that limits us, because I can't revert the hash function without a 16 character long serial num, so maybe we it's better to stick with the default mediatek serial, so maybe we can avoid these |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 what happens if you set the second part of the SoC ID as the fastboot key? |
Beta Was this translation helpful? Give feedback.
-
|
I'm so pissed off at Motorola Agents |
Beta Was this translation helpful? Give feedback.
-
|
I noticed something strange... |
Beta Was this translation helpful? Give feedback.
-
|
I think lk uses the same crypto functions as preloader, which is not that great because we don't have the implementation, just the compiled library. But a positive thing of this is that we have what could be a possible implementation in mtk client. Another problem is that I don't really understand what the code is actually doing, probably it isn't get decompiled correctly, some functions have 2 declared parameters but then get called with 3 or more... I only know some sort of sha256 function is involved, but the why isn't it correct? Maybe we aren't parsing it correctly before giving it to the sha256 function? I might try IDA when I have time instead of ghidra to see if I get a different result. |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 I'm not sure, but we might get lucky with this It doesn't seem to check the buffer after setting it when issuing a command to fastboot. It uses 64 as max size of the buffer, but I don't see it making all the checks it should! Maybe we can exploit this |
Beta Was this translation helpful? Give feedback.
-
|
It doesn't seem it's easy as filling the file with a bunch of A to overflow the buffer [256] [LK_BOOT] Load 'proinfo' partition to 0x4c5c0b80 (1024 bytes in 0 ms)
[256] begin read proinfo
[256] [PROFILE] mmc read 2 blks in 0 ms: 8KB/s
[256] [LK_BOOT] Load 'proinfo' partition to 0x4c5c0b80 (1024 bytes in 0 ms)
[256] get channel model name from proinfo: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
[256] get odm_carrier proinfo: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
[256] get target product proinfo: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
[256] channel:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,carrier:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,product:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[257] [secure_lk_method] won't support payjoy
[257] [get_AB_OTA_param:1769] p_AB_suffix: _a, AB_retry_count: 1
[257] [SEC_POLICY] reached the end, use default policyI'm not an expert in this field though, so I might be doing something wrong. I've also noticed that the phone doesnt boot now to system, it send me to recovery automatically. |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 can we use the fastboot oem ultraflash command? I saw there's a fastboot oem ultraflash_en which should enable the possibility to use ultraflash. Maybe we can flash protected partition with it? It seem to be a manufacturer/rescue thing, this is how g24 restores its firmware through fastboot |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 could you please try the new python script I've added? I can't try on my device right now, but I'm closer to finding how our device generates oem keys. |
Beta Was this translation helpful? Give feedback.
-
|
@progzone122 @GitFASTBOOT We need to get our device on xda https://xdaforums.com/t/new-device-forum-requests.1660354/post-89933856 |
Beta Was this translation helpful? Give feedback.
-
|
. |
Beta Was this translation helpful? Give feedback.





Uh oh!
There was an error while loading. Please reload this page.
-
https://moto-penangf.github.io/documentation/#/dev/oem-key-algorithm
@shomykohai
Beta Was this translation helpful? Give feedback.
All reactions