1

Is it possible to dump the internal storage of an unrooted, boot-looping Android 9 with locked bootloader via USB or to SD card, e.g. using some firmware tool in download or recovery mode?

If YES, what is the procedure, and if NO, how exactly does Android prevent read access while simultaneously allowing full read & write access in download mode (= required for flashing/updating firmware files)? Shouldn't it be possible to read out data from disk if it's possible to write data to disk?

6
  • Is that a yes or no?
    – kerstin92
    Jun 23 at 23:34
  • Also for now...decryption is secondary (and not part of the question either). First I need to see into the device storage as I'm literally facing a brick with no inside information...I need introspection
    – kerstin92
    Jun 23 at 23:37
  • "If an API only allows writing then this possible without problems." - Is this a definite statement regarding the Android download mode or just a general remark concerning APIs unrelated to the download mode?
    – kerstin92
    Jun 23 at 23:51
  • 1
    yes, it's possible to dump raw partitions. for MediaTek you have BROM + preloader mode. for Qualcomm you have EDL mode. for Exynos you have usb-emergency-recovery (smdk-tools). all of these have extra security, for Samsung mobiles leaked programmers are rare. ask Alexander Tarasikov. of course dump is useless because of encryption and there is no way to backup TEE
    – alecxs
    Jun 24 at 1:26
  • it's possible to dump physical layer (chip off method) or middle layer (easy JTAG). NAND flash file system software exist. it's even possible to fly to the moon, if you have a rocket. I think the cheapest way is buy a second device for experimentation, find a way to hack into and make big money with your solution
    – alecxs
    Jun 24 at 2:26

1 Answer 1

0

What all Samsung devices have in common, download mode (fastboot) has been replaced with proprietary Odin protocol.
Benjamin Dobell (author of Heimdall) has reverse engineered Odin Software, or at least some parts of the protocol by sniffing libusb traffic. I remember that Heimdall can read the PIT from device. So my assumption is there may exist secret commands not yet discovered. If Samsung call the firmware flashing process "Download", then what you're looking for is "Upload" aka read back data off the device. Feeding search engine with some keywords give this answer:

There exist a Heimdall based S-Boot Dump that uses the Exynos exploit SVE-2019-15230 (discovered by Alexander Tarasikov) to dump memory (RAM?) off the device in UPLOAD_MODE.
The vulnerability has been fixed, but there exist other causes (and maybe secret command?) that will switch from download into upload mode.

you can read step by step tutorial here
https://hexdetective.blogspot.com/2017/02/exploiting-android-s-boot-getting.html

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .