bkerler / edl

Inofficial Qualcomm Firehose / Sahara / Streaming / Diag Tools :)
GNU General Public License v3.0
1.47k stars 356 forks source link

VIP img authentication failed #492

Open niamotullah opened 5 months ago

niamotullah commented 5 months ago

I'm tring to unbrick my OnePlus 10 Pro, I have read that i need signed images, but i don't know what is it means or how to get one. Can someone educate me or a way to get around that?

# ./edl qfil ./edll/extracted/rawprogram0.xml ./edll/extracted/patch0.xml ./edll/extracted  --loader=./edll/extracted/prog_firehose_ddr.elf --memory=ufs
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2023.
main - Using loader ./edll/extracted/prog_firehose_ddr.elf ...
main - Waiting for the device
......
main - Hint:   Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
        Run "./fastpwn oem edl".
main - Other:  Run "adb reboot edl".

...........main - Device detected :)
sahara - Protocol version: 3, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x3
------------------------
Serial:            0x1234

sahara - Protocol version: 3, Version supported: 1
sahara - Uploading loader ./edll/extracted/prog_firehose_ddr.elf ...
sahara - 64-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose - INFO: Version: SM8450_V1.6 
firehose - INFO: Binary build date: Dec  9 2021 @ 10:33:23
firehose - INFO: Binary build date: Dec  9 2021 @ 10:33:23 
firehose - INFO: Chip serial num: 1234 (0x1234)
firehose - ERROR: devprg_spmi_init: success:0
firehose - ERROR: 0x2646 SpmiBus_ReadLong: success:0x0
firehose - ERROR: 0x2646 r_data: 0x0
firehose - ERROR: 0x2640 r_data: 0x3
firehose - INFO: VIP is enabled, receiving the signed table of size 8192
firehose
firehose - [LIB]: ERROR: VIP img authentication failed with smc_status = 0xfffffffe, rsp_0 = 0x40000b

Files that in got from extracted firmware:

abl.elf                                                   DigestsToSign_pre_provision.bin.mbn      logfs_ufs_8mb.bin      rawprogram5.xml
aop_devcfg.mbn                                            DigestsToSign_provision_hynix.bin.mbn    metadata.img           recovery.img
aop.mbn                                                   DigestsToSign_provision_micron.bin.mbn   NON-HLOS.bin           sec_smt.dat
apdp.mbn                                                  DigestsToSign_provision_samsung.bin.mbn  oplus2084A.bin         Setting.xml
boot.img                                                  DigestsToSign_provision_toshiba.bin.mbn  oplusreserve2.img      shrm.elf
BTFM.bin                                                  DRIVER.ISO                               oplus_sec.mbn          splash.img
ChainedTableOfDigests_2084A_all.bin                       dspso.bin                                patch0.xml             static_nvbk.2084A.bin
ChainedTableOfDigests_2084A_persist_no_userdata_no.bin    dtbo.img                                 patch1.xml             storsec.mbn
ChainedTableOfDigests_2084A_persist_no_userdata_yes.bin   dynamic_nvbk.2084A.bin                   patch2.xml             super.0.4898d9df.img
ChainedTableOfDigests_2084A_persist_yes_userdata_no.bin   emmc_fw.bin                              patch3.xml             super.1.f98a4e17.img
ChainedTableOfDigests_2084A_persist_yes_userdata_yes.bin  engineering_cdt.img                      patch4.xml             super.2.028efbf3.img
ChainedTableOfDigests_nv00000000.bin                      featenabler.mbn                          patch5.xml             tools.fv
ChainedTableOfDigests_nv10100011.bin                      gpt_backup0.bin                          persist.img            tz.mbn
ChainedTableOfDigests_pre_provision.bin                   gpt_backup1.bin                          ProFile.xml            uefi.elf
ChainedTableOfDigests_provision_hynix.bin                 gpt_backup2.bin                          ProFile.xsd            uefi_sec.mbn
ChainedTableOfDigests_provision_micron.bin                gpt_backup3.bin                          prog_firehose_ddr.elf  userdata.img
ChainedTableOfDigests_provision_samsung.bin               gpt_backup4.bin                          Projectconfig.xml      vbmeta.img
ChainedTableOfDigests_provision_toshiba.bin               gpt_backup5.bin                          provision_hynix.xml    vbmeta_system.img
cpucp.elf                                                 gpt_main0.bin                            provision_micron.xml   vbmeta_vendor.img
devcfg.mbn                                                gpt_main1.bin                            provision_samsung.xml  vendor_boot.img
DigestsToSign_2084A_all.bin.mbn                           gpt_main2.bin                            provision_toshiba.xml  xbl_config.elf
DigestsToSign_2084A_persist_no_userdata_no.bin.mbn        gpt_main3.bin                            qupv3fw.elf            XblRamdump.elf
DigestsToSign_2084A_persist_no_userdata_yes.bin.mbn       gpt_main4.bin                            rawprogram0.xml        xbl_s.melf
DigestsToSign_2084A_persist_yes_userdata_no.bin.mbn       gpt_main5.bin                            rawprogram1.xml        zeros_5sectors.bin
DigestsToSign_2084A_persist_yes_userdata_yes.bin.mbn      hypvm.mbn                                rawprogram2.xml
DigestsToSign_nv00000000.bin.mbn                          imagefv.elf                              rawprogram3.xml
DigestsToSign_nv10100011.bin.mbn                          keymint.mbn                              rawprogram4.xml
Boom-Hacker commented 2 months ago

https://github.com/bkerler/Loaders/blob/a83850577f32faaf4694cda8f00666e0d9d34654/oneplus/0000000000020000_467f3020c4cc788d_fhprg_op10pro.bin

Boom-Hacker commented 2 months ago

if you success,plz tell me.I have a 11r,it's 8+ gen1

niamotullah commented 2 months ago

bkerler/Loaders@a838505/oneplus/0000000000020000_467f3020c4cc788d_fhprg_op10pro.bin

I guess i have tried that one but it failed. I got my device fixed by a paid tool. I still don't know what a third-party tool does that we can't