search

curtisy1 / OppoUnlocker

Experimental app for faking Oppo phones into thinking they have permission to unlock root
14 stars 6 forks source link

apk please #1

Open ghost opened 2 years ago

ghost commented 2 years ago

Can you build the apk for me please ?

curtisy1 commented 2 years ago

That won't be possible, unfortunately. The code, as far as I remember, is mostly just a partly reversed version of the official unlocker app Oppo provides. As such, it doesn't go as far as being able to build or even run and only spits out thousands of errors.

I eventually stopped the reversing work since Oppo relies on system APIs that I can't access no matter what I try. The best attack vector would be imitating what their app does instead and use their unlocker API but that is a lot of effort I can't spare at the moment.

Sorry to disappoint!

slonopot commented 2 years ago

@curtisy1 if you still have your Oppo device, you might try these approaches:

  1. The system API you've mentioned is most likely being used just to check the unlock state, the actual job is being made at com.coloros.deeptesting.activity.j: ((PersistentDataBlockManager) this.a.getSystemService("persistent_data_block")).setOemUnlockEnabled(true); It just toggles the OEM Unlock switch in the Developer settings (which is hidden for user?). Next, you will simply need to facebook oem unlock with google platform tools or use this thing here cuz Vivo and Oppo are both made by BBK.

  2. The app doesn't seem to use any custom network config, you gotta check if the app will trust the user CA storage. Try using Fiddler (Charles, Burp Suite) for a simple MITM, if the app fails to work with system proxy (you don't see any requests at all) then try Droni. If the app will allow to mess with the requests, then you should be able to simply change false to true and succeed.

I don't have any Oppo devices because of this dumb unlock policy so I hope you'll be able to test these things and see if anything works. Good luck.