1

I am trying to get a rooted android phone set up for reverse engineering purposes. I tried to root two separate phones (SM-G925A and a Google Pixel 2) but they both turned out to have locked (meaning, encrypted by the carrier) bootloaders.

Is there really no way to get around this without finding an exploit? I have tried everything short of taking the phone apart and flashing the ROM in (whatever device you use to flash a ROM chip.) Would that even work? I can't even find a single example of someone doing this for any model of phone on the internet.

8
  • A bootloader does not encrypt or decrypt anything. Hence a bootloader is never encrypted. I assume you are referring to the digital signature that can be checked by the bootloader but again neither the bootloader nor the checked software is encrypted. – Robert Jan 16 at 22:29
  • @Robert indeed bootloader lock state is encrypted, but that's different topic – alecxs Jan 17 at 11:14
  • @alecxs Are you really sure you mean encryption and not cryptographically tamper protected? Do you have any reference for the encryption in bootloader? – Robert Jan 17 at 13:43
  • @alecxs If the bootloader is OEM locked, you can't unlock the bootloader without using an exploit. For both the pixel 2 (verizon model) and SM-G925A, there are currently no known exploits. I'm 100% sure about this. – firstname gklsodascb Jan 17 at 13:49
  • @Robert I'm not completely sure how it works honestly, you could be right about that – firstname gklsodascb Jan 17 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.