Hovatek Forum
Review:Itel A32F hands-on review... READ MORE (Jun, 2018)
Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - Printable Version

+- Hovatek Forum (https://forum.hovatek.com)
+-- Forum: DEVELOPMENT (https://forum.hovatek.com/forum-38.html)
+--- Forum: Android (https://forum.hovatek.com/forum-39.html)
+--- Thread: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security (/thread-15695.html)

Pages: 1 2 3 4


Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - techyzen101 - 10-25-2016

Recently bought this phone, and took an interest in flashing custom ROMs on it.
Though sadly, it was not possible due to:

1. SPL security check
- Dumped from device, opened in a hex editor and saw some strings about hash and magic (VLR MAGIC) being checked before booting the second bootloader.

2. Second Bootloader U-boot security check
- Same process and again there's some hash and magic checking, aside from the usual strings seen from u-boot.

The second bootloader and the boot image both contain a SPRD-SECUREFLAG header at base 0x0 of size 1024 bytes with some kind of encrypted hash(?), before the actual binary contents, android magic, etc.

I've found the related source-code for the u-boot, looked through it and saw that there is an RSA Encryption whenever binaries get flashed, though the last update of the source was at 2014 (and Spreadtrum probably closed it from public since I can't find any, aside from cloned ones in github), and the device release was 2015.

The bootloader is factory unlocked (?) or just a string hardcoded in the bootloader to show it is, and Huawei's unlock service is useless anyway for this device since the code for getting the Product ID does not work, and there is no "oem unlock" string anywhere in the u-boot binary.

I've been trying to find other devices with the same specifications and chip (and unsecured/unlockable bootloader) to try their PAC format ROM but not a single one actually flashed completely (UART error after FDL1 download) with the SPRD flashtool.

I'll post screenshots if needed.


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - techyzen101 - 10-28-2016

After some digging, and editing, u-boot was able to compile, but the FDLs and SPL are non-existent so still no unsecured flashing.

ro.product.hardware is "SP7731GEA_V1.0.0"
ro.hardware is "sc8830"

Found another source for u-boot, supports most spreadtrum chips, but it does not compile out of the box (at least sc8830 as tested). I'm not quite in good terms with full source-code editing so, I'll keep things as it is for now.

Old & Specifically edited for sc7731 already here.
Kinda newer and complete here.


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - techyzen101 - 10-31-2016

Emailed to Huawei Support about this, hoping for the best.

By the way here are some of the ROM dump I have made [ Please, Register to unhide this download link] if it helps.
In the package is boot.img, recovery.img, mmcboot0.bin (SPL), mmcboot1.bin (U-BOOT)


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - anil dasari - 11-01-2016

Thanks for the information please develop some roms like lollipop or marshmallow we are eagerly waiting since 1 year


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - anil dasari - 11-01-2016

i'm hopping you will be the one you can do it man


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - techyzen101 - 11-10-2016

Recieved Huawei Support's response on the matter and sadly, it's impossible.

Though, not giving up yet as theres still some other ways: using bootloaders from different region PAC firmwares. I have heard that chinese versions of the firmware for our device have their bootloader unlocked, so there might be hope.


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - anil dasari - 11-11-2016

(11-10-2016, 10:32 AM)techyzen101 Wrote:  Recieved Huawei Support's response on the matter and sadly, it's impossible.

Though, not giving up yet as theres still some other ways: using bootloaders from different region PAC firmwares. I have heard that chinese versions of the firmware for our device have their bootloader unlocked, so there might be hope.

Best of luck try till you get the same

Sent from my Elite Plus using Hovatek mobile


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - techyzen101 - 11-29-2016

Putting this at a pause since I do not have the know how, instead, we will probably wait for an able body to shed some light on this situation.

Try the modified stock ROM that I made for now.
https://forum.hovatek.com/thread-15761.html


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - anil dasari - 12-03-2016

(11-29-2016, 01:36 PM)techyzen101 Wrote:  Putting this at a pause since I do not have the know how, instead, we will probably wait for an able body to shed some light on this situation.

Try the modified stock ROM that I made for now.
https://forum.hovatek.com/thread-15761.html

Will this work in Indian devices

Sent from my Elite Plus using Hovatek mobile


RE: Huawei Y5C/Y541-U02/Honor Bee Bootloader Security - techyzen101 - 12-03-2016

(12-03-2016, 04:28 AM)anil┬ádasari Wrote:  Will this work in Indian devices

Sent from my Elite Plus using Hovatek mobile

I am not sure, so please create a backup first. I will post the dumping/backup guide soon.

And I advise that you update to B116 after backing up.