MlgmXyysd / Xiaomi-HyperOS-BootLoader-Bypass

A PoC that exploits a vulnerability to bypass the Xiaomi HyperOS community restrictions of BootLoader unlocked account bindings.
https://www.neko.ink/
2.65k stars 299 forks source link

No longer works #105

Closed TheAirBlow closed 5 months ago

TheAirBlow commented 5 months ago

Xiaomi changed the way logs are encrypted and the keys in the source code are no longer valid. \ The new algorithm is located at com.android.settings.bootloader.LogEncryptor inside com.android.settings.

P.S. They use a public key to encrypt with no private key in the source code. You're better off making those requests manually using the code from CloudDeviceStatus and Utils.

P.S. You can't as most of the stuff requires the application to be a system one or signed by Xiaomi.

TheAirBlow commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Tigercat000 commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

TheAirBlow commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

I didn't make a good tutorial yet. If this bypass doesn't work - follow the instructions in the warning section.

Tigercat000 commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

I didn't make a good tutorial yet. If this bypass doesn't work - follow the instructions in the warning section.

Thanks for your reply , that was show this: PS C:\HyperFuck-main> # connect your Android device before continuing PS C:\HyperFuck-main> # make sure to enable USB debugging PS C:\HyperFuck-main> python main.py PS C:\HyperFuck-main> adb push Settings.apk /data/local/tmp/Settings.apk adb server is out of date. killing...

Exception occurred while executing 'install': java.lang.IllegalArgumentException: Error: Failed to parse APK file: /data/local/tmp/Settings.apk: Failed to parse /data/local/tmp/Settings.apk at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:717) at com.android.server.pm.PackageManagerShellCommand.doRunInstall(PackageManagerShellCommand.java:1577) at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:1543) at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:236) at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97) at android.os.ShellCommand.exec(ShellCommand.java:38) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:6551) at android.os.Binder.shellCommand(Binder.java:1075) at android.os.Binder.onTransact(Binder.java:895) at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4352) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6535) at android.os.Binder.execTransactInternal(Binder.java:1351) at android.os.Binder.execTransact(Binder.java:1282) Caused by: java.io.IOException: Failed to load asset path /data/local/tmp/Settings.apk from fd 662 at android.content.res.ApkAssets.nativeLoadFd(Native Method) at android.content.res.ApkAssets.(ApkAssets.java:309) at android.content.res.ApkAssets.loadFromFd(ApkAssets.java:180) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLiteInner(ApkLiteParseUtils.java:356) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLite(ApkLiteParseUtils.java:344) at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:711) ... 12 more

TheAirBlow commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

I didn't make a good tutorial yet. If this bypass doesn't work - follow the instructions in the warning section.

Thanks for your reply , that was show this: PS C:\HyperFuck-main> # connect your Android device before continuing PS C:\HyperFuck-main> # make sure to enable USB debugging PS C:\HyperFuck-main> python main.py PS C:\HyperFuck-main> adb push Settings.apk /data/local/tmp/Settings.apk adb server is out of date. killing...

* daemon started successfully *
  0 KB/s (134 bytes in 1.000s)
  PS C:\HyperFuck-main> adb shell pm install -r -d /data/local/tmp/Settings.apk

Exception occurred while executing 'install': java.lang.IllegalArgumentException: Error: Failed to parse APK file: /data/local/tmp/Settings.apk: Failed to parse /data/local/tmp/Settings.apk at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:717) at com.android.server.pm.PackageManagerShellCommand.doRunInstall(PackageManagerShellCommand.java:1577) at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:1543) at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:236) at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97) at android.os.ShellCommand.exec(ShellCommand.java:38) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:6551) at android.os.Binder.shellCommand(Binder.java:1075) at android.os.Binder.onTransact(Binder.java:895) at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4352) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6535) at android.os.Binder.execTransactInternal(Binder.java:1351) at android.os.Binder.execTransact(Binder.java:1282) Caused by: java.io.IOException: Failed to load asset path /data/local/tmp/Settings.apk from fd 662 at android.content.res.ApkAssets.nativeLoadFd(Native Method) at android.content.res.ApkAssets.(ApkAssets.java:309) at android.content.res.ApkAssets.loadFromFd(ApkAssets.java:180) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLiteInner(ApkLiteParseUtils.java:356) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLite(ApkLiteParseUtils.java:344) at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:711) ... 12 more

You cloned the repo without LFS files. Install Git LFS or use the ZIP download feature.

Tigercat000 commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

I didn't make a good tutorial yet. If this bypass doesn't work - follow the instructions in the warning section.

Thanks for your reply , that was show this: PS C:\HyperFuck-main> # connect your Android device before continuing PS C:\HyperFuck-main> # make sure to enable USB debugging PS C:\HyperFuck-main> python main.py PS C:\HyperFuck-main> adb push Settings.apk /data/local/tmp/Settings.apk adb server is out of date. killing...

* daemon started successfully *
  0 KB/s (134 bytes in 1.000s)
  PS C:\HyperFuck-main> adb shell pm install -r -d /data/local/tmp/Settings.apk

Exception occurred while executing 'install': java.lang.IllegalArgumentException: Error: Failed to parse APK file: /data/local/tmp/Settings.apk: Failed to parse /data/local/tmp/Settings.apk at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:717) at com.android.server.pm.PackageManagerShellCommand.doRunInstall(PackageManagerShellCommand.java:1577) at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:1543) at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:236) at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97) at android.os.ShellCommand.exec(ShellCommand.java:38) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:6551) at android.os.Binder.shellCommand(Binder.java:1075) at android.os.Binder.onTransact(Binder.java:895) at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4352) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6535) at android.os.Binder.execTransactInternal(Binder.java:1351) at android.os.Binder.execTransact(Binder.java:1282) Caused by: java.io.IOException: Failed to load asset path /data/local/tmp/Settings.apk from fd 662 at android.content.res.ApkAssets.nativeLoadFd(Native Method) at android.content.res.ApkAssets.(ApkAssets.java:309) at android.content.res.ApkAssets.loadFromFd(ApkAssets.java:180) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLiteInner(ApkLiteParseUtils.java:356) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLite(ApkLiteParseUtils.java:344) at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:711) ... 12 more

You cloned the repo without LFS files. Install Git LFS or use the ZIP download feature.

Try to Install Git LFS but show could not find Git can not register git lfs How can install it ? Thanks

TheAirBlow commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

I didn't make a good tutorial yet. If this bypass doesn't work - follow the instructions in the warning section.

Thanks for your reply , that was show this: PS C:\HyperFuck-main> # connect your Android device before continuing PS C:\HyperFuck-main> # make sure to enable USB debugging PS C:\HyperFuck-main> python main.py PS C:\HyperFuck-main> adb push Settings.apk /data/local/tmp/Settings.apk adb server is out of date. killing...

* daemon started successfully *
  0 KB/s (134 bytes in 1.000s)
  PS C:\HyperFuck-main> adb shell pm install -r -d /data/local/tmp/Settings.apk

Exception occurred while executing 'install': java.lang.IllegalArgumentException: Error: Failed to parse APK file: /data/local/tmp/Settings.apk: Failed to parse /data/local/tmp/Settings.apk at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:717) at com.android.server.pm.PackageManagerShellCommand.doRunInstall(PackageManagerShellCommand.java:1577) at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:1543) at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:236) at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97) at android.os.ShellCommand.exec(ShellCommand.java:38) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:6551) at android.os.Binder.shellCommand(Binder.java:1075) at android.os.Binder.onTransact(Binder.java:895) at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4352) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6535) at android.os.Binder.execTransactInternal(Binder.java:1351) at android.os.Binder.execTransact(Binder.java:1282) Caused by: java.io.IOException: Failed to load asset path /data/local/tmp/Settings.apk from fd 662 at android.content.res.ApkAssets.nativeLoadFd(Native Method) at android.content.res.ApkAssets.(ApkAssets.java:309) at android.content.res.ApkAssets.loadFromFd(ApkAssets.java:180) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLiteInner(ApkLiteParseUtils.java:356) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLite(ApkLiteParseUtils.java:344) at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:711) ... 12 more

You cloned the repo without LFS files. Install Git LFS or use the ZIP download feature.

Try to Install Git LFS but show could not find Git can not register git lfs How can install it ? Thanks

Install git lol

or just download the APK directly from github by clicking Raw.

Tigercat000 commented 5 months ago

You can rollback to an older version of the settings app, which can be found here

Please help to explain how to use this Hyperfuck?thanks

I didn't make a good tutorial yet. If this bypass doesn't work - follow the instructions in the warning section.

Thanks for your reply , that was show this: PS C:\HyperFuck-main> # connect your Android device before continuing PS C:\HyperFuck-main> # make sure to enable USB debugging PS C:\HyperFuck-main> python main.py PS C:\HyperFuck-main> adb push Settings.apk /data/local/tmp/Settings.apk adb server is out of date. killing...

* daemon started successfully *
  0 KB/s (134 bytes in 1.000s)
  PS C:\HyperFuck-main> adb shell pm install -r -d /data/local/tmp/Settings.apk

Exception occurred while executing 'install': java.lang.IllegalArgumentException: Error: Failed to parse APK file: /data/local/tmp/Settings.apk: Failed to parse /data/local/tmp/Settings.apk at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:717) at com.android.server.pm.PackageManagerShellCommand.doRunInstall(PackageManagerShellCommand.java:1577) at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:1543) at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:236) at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97) at android.os.ShellCommand.exec(ShellCommand.java:38) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onShellCommand(PackageManagerService.java:6551) at android.os.Binder.shellCommand(Binder.java:1075) at android.os.Binder.onTransact(Binder.java:895) at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:4352) at com.android.server.pm.PackageManagerService$IPackageManagerImpl.onTransact(PackageManagerService.java:6535) at android.os.Binder.execTransactInternal(Binder.java:1351) at android.os.Binder.execTransact(Binder.java:1282) Caused by: java.io.IOException: Failed to load asset path /data/local/tmp/Settings.apk from fd 662 at android.content.res.ApkAssets.nativeLoadFd(Native Method) at android.content.res.ApkAssets.(ApkAssets.java:309) at android.content.res.ApkAssets.loadFromFd(ApkAssets.java:180) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLiteInner(ApkLiteParseUtils.java:356) at android.content.pm.parsing.ApkLiteParseUtils.parseApkLite(ApkLiteParseUtils.java:344) at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:711) ... 12 more

You cloned the repo without LFS files. Install Git LFS or use the ZIP download feature.

Try to Install Git LFS but show could not find Git can not register git lfs How can install it ? Thanks

Install git lol

or just download the APK directly from github by clicking Raw.

Install git already , I download HyperFuck zip ,after unzip file but can't install setting.apk,thanks

conflagration27 commented 5 months ago

Will this work on devices that have HyperOS CN installed from the factory? Such as Xiaomi 14 series, Redmi K70 etc ty

drus519 commented 5 months ago

Got error:

$ python3 main.py 
Found Xiaomi Xiaomi (board shennong, codename shennong)
Is this correct? (y/N): y
Open MI Unlock Status and request permission
Disabling mobile internet, taking over!
Decrypting arguments from logs
Decrypting headers from logs
Impersonating MIUI 14 to bypass requirements
Sending forged account binding request
Device forced to verify through Mi Community (30001)

This is the end?(

TheAirBlow commented 5 months ago

Got error:

$ python3 main.py 
Found Xiaomi Xiaomi (board shennong, codename shennong)
Is this correct? (y/N): y
Open MI Unlock Status and request permission
Disabling mobile internet, taking over!
Decrypting arguments from logs
Decrypting headers from logs
Impersonating MIUI 14 to bypass requirements
Sending forged account binding request
Device forced to verify through Mi Community (30001)

This is the end?(

Yup, can't do anything.

Tigercat000 commented 5 months ago

Is too sad end of K70 series ,but thanks all of your hard work ,appreciate.

TheAirBlow commented 5 months ago

@Tigercat000 Try HyperSploit, it's quite a bit more user-friendly with the downgrading shenanigans.

Tigercat000 commented 5 months ago

@Tigercat000 Try HyperSploit, it's quite a bit more user-friendly with the downgrading shenanigans.

Thanks buddy , appreciate

TheAirBlow commented 5 months ago

I'm going to close this as the author is clearly aware of the issue judging by their twitter posts

spiderfix101 commented 4 months ago

I need to unlock the bootloader on Redmi Note 13 Pro 5G China version. Will this work on this device?

TheAirBlow commented 4 months ago

I need to unlock the bootloader on Redmi Note 13 Pro 5G China version. Will this work on this device?

Chinese devices are basically fucked.