1

Problem

I'd like to know the proper process of "hacking" emmc_appsboot.mbn in order to flash already an unlocked bootloader from start. I didn't want to ask for a file from an already unlocked phone because I'm interested in the process and how it works.

What I did

I tried myself editing with a hex editor the line after ANDROID BOOT! and changed the hex from 00 to 01 but the phone was perfectly bricked :D and I had to spend some times with the drivers (Qualcomm 9008) and learning how to put it in EDL mode with the phone not even fastbooting, afterwards I was able to "msmdownload" it again reflashing everything. I can now in fastboot and recovery.

I also tried replacing the recovery, with twrp, and actually it failed when going to recovery because of the md5 checksum.

I hex-edited both md5.img and md5sum.md5 files replacing the md5 of recovery.img with the one of twrp (renamed recovery.img of course) but still, it failed nonetheless the md5 checksum.

I suppose there is some other file where these hash's are stored and are checked during boot.

Is it safe to assume that emmc_appsboot.mbn as well is checksumed and if it fails it doesn't load at all?

What's the correct process in:

1) Editing emmc_appsboot.mbn in order to unlock the bootloader

2) Making the system actually boot and work after we edited those files (probably security checks / hash's are involved).

IMPORTANT: Please do not suggest "how to unlock the bootloader" with usb-debugging etc, the well known methods that are well known, kindly

Reference : You can download here the MSMDownloadTool with all the ROM / OP3 related files.

Improve this question
1
  • 1
    Application bootloader's (aboot) source is proprietary content, not open source. So the bits to be changed in a compiled binary (.mbn file) may differ for different OEMs, different phones and even for different firmware versions of same phone. If there are proper methods available to do such things, this is no more "hacking" :)
    – Irfan Latif
    Feb 6, 2019 at 20:53

1 Answer 1

Reset to default
2

Here’s what anyone should do if it’s in a similar situation:

Do a full unbrick method 1 from here

Download OxygenOS 4.0.0 (Android 7.0) , OnePlus3Oxygen_16_OTA_035_all_1612310359_e10cadfb2af7.zip.

adb sideload the file above when in recovery. Why this version? Because it’s vulnerable to CVE-2017-5626 and CVE-2017-5624. Weirdly enough, my phone turned back from the dead after this; however if it didn’t work (as I was expecting) , I would go into fastboot mode and unlock the bootloader from there with:

fastboot oem 4F500301

Which will completely bypass the oem mechanism and will unlock your bootloader even if you can’t boot the system and go to the developer menu.

This backdoor was removed by OnePlus with OxygenOS 4.0.2 (“patched”).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .