Hi, Guest! Login / Register




Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5

Huawei Y5C/Y541-U02/Honor Bee Bootloader Security

#1
Question  (This post was last modified: 10-25-2016, 06:37 AM by techyzen101. )

Recently bought this phone, and took an interest in flashing custom ROMs on it.
Though sadly, it was not possible due to:

1. SPL security check
- Dumped from device, opened in a hex editor and saw some strings about hash and magic (VLR MAGIC) being checked before booting the second bootloader.

2. Second Bootloader U-boot security check
- Same process and again there's some hash and magic checking, aside from the usual strings seen from u-boot.

The second bootloader and the boot image both contain a SPRD-SECUREFLAG header at base 0x0 of size 1024 bytes with some kind of encrypted hash(?), before the actual binary contents, android magic, etc.

I've found the related source-code for the u-boot, looked through it and saw that there is an RSA Encryption whenever binaries get flashed, though the last update of the source was at 2014 (and Spreadtrum probably closed it from public since I can't find any, aside from cloned ones in github), and the device release was 2015.

The bootloader is factory unlocked (?) or just a string hardcoded in the bootloader to show it is, and Huawei's unlock service is useless anyway for this device since the code for getting the Product ID does not work, and there is no "oem unlock" string anywhere in the u-boot binary.

I've been trying to find other devices with the same specifications and chip (and unsecured/unlockable bootloader) to try their PAC format ROM but not a single one actually flashed completely (UART error after FDL1 download) with the SPRD flashtool.

I'll post screenshots if needed.


Reply
#2
After some digging, and editing, u-boot was able to compile, but the FDLs and SPL are non-existent so still no unsecured flashing.

ro.product.hardware is "SP7731GEA_V1.0.0"
ro.hardware is "sc8830"

Found another source for u-boot, supports most spreadtrum chips, but it does not compile out of the box (at least sc8830 as tested). I'm not quite in good terms with full source-code editing so, I'll keep things as it is for now.

Old & Specifically edited for sc7731 already here.
Kinda newer and complete here.
Reply
#3
Emailed to Huawei Support about this, hoping for the best.

By the way here are some of the ROM dump I have made here if it helps.
In the package is boot.img, recovery.img, mmcboot0.bin (SPL), mmcboot1.bin (U-BOOT)
Reply
#4
Thanks for the information please develop some roms like lollipop or marshmallow we are eagerly waiting since 1 year
Reply
#5
i'm hopping you will be the one you can do it man
Reply
#6
Recieved Huawei Support's response on the matter and sadly, it's impossible.

Though, not giving up yet as theres still some other ways: using bootloaders from different region PAC firmwares. I have heard that chinese versions of the firmware for our device have their bootloader unlocked, so there might be hope.
Reply
#7
(11-10-2016, 10:32 AM)techyzen101 Wrote: Recieved Huawei Support's response on the matter and sadly, it's impossible.

Though, not giving up yet as theres still some other ways: using bootloaders from different region PAC firmwares. I have heard that chinese versions of the firmware for our device have their bootloader unlocked, so there might be hope.

Best of luck try till you get the same

Sent from my Elite Plus using Hovatek mobile
Reply
#8
(This post was last modified: 11-29-2016, 01:40 PM by techyzen101. )
Putting this at a pause since I do not have the know how, instead, we will probably wait for an able body to shed some light on this situation.

Try the modified stock ROM that I made for now.
https://forum.hovatek.com/thread-15761.html

Reply
#9
(11-29-2016, 01:36 PM)techyzen101 Wrote: Putting this at a pause since I do not have the know how, instead, we will probably wait for an able body to shed some light on this situation.

Try the modified stock ROM that I made for now.
https://forum.hovatek.com/thread-15761.html

Will this work in Indian devices

Sent from my Elite Plus using Hovatek mobile
Reply
#10
(12-03-2016, 04:28 AM)anil dasari Wrote: Will this work in Indian devices

Sent from my Elite Plus using Hovatek mobile

I am not sure, so please create a backup first. I will post the dumping/backup guide soon.

And I advise that you update to B116 after backing up.
Reply










Users browsing this thread:
1 Guest(s)