My Oneplus 5 got softbricked (touch input completely stopped working some time after an update and nothing could be done about it). This happened soon (a couple of weeks) after it was updated to stable OxygenOS 9.0.3 (first Pie-based ROM for my device), bootloader was locked.

It was not easy, but I managed to get images of all the phone's partitions via Qualcomm EDL mode. Then I factory reset ("unbricked") it using "MSMDownloadTool" provided by Oneplus (which uses EDL as well).

Needless to say, most of the extracted userdata partition (which should contain all my files, e.g. photos) is encrypted. The encryption method is FBE. I also used a PIN lock (which I know).

What I am trying to understand if it possible to decrypt the files. My very basic understanding is that this involves some keys specific to my unit (so can only be done on the device itself?) and also some keys found on the userdata image in a "unencrypted" directory and some further keys which are encrypted using the former.

In some initial attempts to decrypt the data I have since unlocked the bootloader and rooted the phone.

So my questions are:

1) Is this theoretically possible? Could the modifications to the phone's firmware I have already done wiped something necessary for decryption, which was not stored on disk (in userdata or another partition)?

2) Can anyone provide any manual as to how this could be approached? I have found a manual for Huawei Mate 9 on xda-developers but could not follow it (vold directory missing in misc, probably encrypted).

3) If not, what documentation / source code would you recommend studying?

  • The AOSP documentation says that the keys are held by the Trusted Execution Environment (TEE). And the TEE is re-initialized by a factory reset (or in detail on the first boot after factory reset). I am not sure where the TEE data is stored but it seems to be nearly impossible to get the TEE into the correct state to be able to access the decryption keys.
    – Robert
    Commented Feb 17, 2019 at 15:21
  • @Robert Do you mean that TEE data is stored somewhere outside the devices main flash memory? Also, could you provide a reference regarding TEE being reset on first boot?
    – amakh
    Commented Feb 18, 2019 at 0:34
  • I am not an TEE expert, but from my understanding the data is stored in the same flash as user data but encrypted in a way only the TEE can access it. The initialization/enrollment of the TEE is documented here: source.android.com/security/authentication#enrollment
    – Robert
    Commented Feb 18, 2019 at 8:29
  • Thanks for the link. Also, as said, I do have a dump of the phones entire filesystem, so if TEE data is in one of the partitions, I could just flash it back onto the device (that alone would likely not be enough though). Incidentally, I do see some partitions that may be relevant ("tz", "keymaster", "keystore") but none of their contents actually changed after the factory reset.
    – amakh
    Commented Feb 18, 2019 at 10:24


You must log in to answer this question.

Browse other questions tagged .