search

darknight1050 / quest-bootloader-unlocker

MIT License
35 stars 1 forks source link

Quest 2 (16476800118700000) crashes but does not unlock. Issue with extracting bootloader binary? #2

Open kjh96 opened 5 months ago

kjh96 commented 5 months ago

Hi, I have a Quest 2 on 16476800118700000 (which the latest release is compatible with) that I am trying to unlock.

I am able to extract abl.img from the payload.bin in the 16476800118700000 update zip, but when I run uefi-firmware-parser on the abl.img it does not output any files. Using it in 'test' mode tells me that it's an 'unknown' file type.

I am more familiar with UEFITool, a GUI tool which serves a similar purpose, and I'm able to extract/uncompress the abl.img that way. The result is a binary with a 'LinuxLoader' header, ~657kb in size.

I've tried renaming it to 'q2_16476800118700000.pe' and running your quest-bootloader-unlocker.exe, and the result is that the device crashes (so the exploit works) but it does not unlock:

quest-bootloader-unlocker.exe Build number: 16476800118700000! Unlock Device? y/n

Finished! Press any key to close...

I think I'm missing a step here, probably due to not extracting the .pe correctly. Could you share how you were able to extract it? Or what the hash of q2_16476800118700000.pe is supposed to be? And thank you for sharing this tool!

darknight1050 commented 5 months ago

Hey, I extracted it with https://github.com/theopolis/uefi-firmware-parser, size should be 671’744 bytes and the SHA256 is 67D424FD540D9F598285B54AA151BBA25CF181B965B3AC4D65DE3F6A92C39675. You can text me on discord @darknight1050 if you still have problems getting it to work.