search

bkerler / Loaders

EDL Loaders
298 stars 90 forks source link

Add sahara v3 firehose support device list #95

Open soralis0912 opened 7 months ago

soralis0912 commented 7 months ago

Sahara v3 is no show PKHASH need --loader option But now filename is difficulty

So I think add support device list file

soralis0912 commented 7 months ago

like this format

filename,manufacturer,devicename,pkhash
RenateUSB commented 6 months ago

If you can pull one of the system files (xbl, abl, cmnlib, modem...) off your device (or an update) you can get the PK hash that way.

RenateUSB commented 2 months ago

I think it's worse than that, possibly. I think that the format for Secure Boot files has changed and that they are now compressed/encrypted. I'm looking at a Motorola Firehose loader and it's nothing like the ones we know. It's in ELF format, but the giveaway is the CPU field is zero and it's a 32 bit ELF.

32 bit ELF
CPU:    AT&T WE 32100
RenateUSB commented 2 months ago

There are a dozen of these CPU=0 files elsewhere, but here are 4 on this repo:

https://github.com/bkerler/Loaders/blob/main/lenovo_motorola/0000000002e80000_467f3020c4cc788d_fhprg.bin https://github.com/bkerler/Loaders/blob/main/lenovo_motorola/001870e102e80000_467f3020c4cc788d_fhprg.bin https://github.com/bkerler/Loaders/blob/main/nothing/000b80e100020000_467f3020c4cc788d_fhprg.bin https://github.com/bkerler/Loaders/blob/main/oneplus/0000000000020000_467f3020c4cc788d_fhprg_op10pro.bin

RenateUSB commented 2 months ago

Ok, it's simply 5 stacked ELF files. The signing isn't even the same as the normal single ELFs. The 4 ELFs on the end use an incompatible Version 7 header for the signing. Two are signed by Qualcomm, two are signed by the OEM.

hoplik commented 3 weeks ago

Hi, all! RenateUSB respect! You're right, as always, Hawkeye! These new programmers come with version number 7 (address 1004). These are five elf files assembled into one elf. There are 18-30 certificates and choosing the hash of one root of them will not solve the problem completely, because the file name can be generated, but it is not possible to request a hash from the device. It is necessary to understand the specification of the Sahara v3.0 protocol and the operation of the device according to it. Here I tried to disassemble the fifth elf to get the device tree. Apparently, these are the first steps towards a new algorithm for analyzing programmers. https://4pda.to/forum/index.php?showtopic=643084&view=findpost&p=128019877 A couple of pages earlier there is a link to a new programer for analysis from Huawei Mate. And here's another one I recently got together with the guys from India for Motorola. https://xdaforums.com/t/moto-g-stylus-xt2315-5g-firehose.4699293/

RenateUSB commented 3 weeks ago

Oh, qcomview.exe has handled the "stacked" ELFs for a while now. I just uploaded the latest version.