OnePlus 6 (oneplus-enchilada)/Hacking: Difference between revisions
Appearance
Created page with "= Hacking on the OnePlus 6 = The OnePlus 6 is a pretty good device for lowlevel hacking, if you're already comfortable with lowlevel Qualcomm here's a quick rundown: * [http..." |
Added internal link to OnePlus 6 |
||
Line 1: | Line 1: | ||
= Hacking on the OnePlus 6 = | = Hacking on the OnePlus 6 = | ||
The OnePlus 6 is a pretty good device for lowlevel hacking, if you're already comfortable with lowlevel Qualcomm here's a quick rundown: | The [[OnePlus 6 (oneplus-enchilada)|OnePlus 6]] is a pretty good device for lowlevel hacking, if you're already comfortable with lowlevel Qualcomm here's a quick rundown: | ||
* [https://github.com/bkerler/edl bkerler's fantastic EDL tool] contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table, as long as you stay within the constraints of the bootloader. | * [https://github.com/bkerler/edl bkerler's fantastic EDL tool] contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table, as long as you stay within the constraints of the bootloader. |
Revision as of 13:08, 3 October 2021
Hacking on the OnePlus 6
The OnePlus 6 is a pretty good device for lowlevel hacking, if you're already comfortable with lowlevel Qualcomm here's a quick rundown:
- bkerler's fantastic EDL tool contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table, as long as you stay within the constraints of the bootloader.
- The ABL has been modified a fair bit by OnePlus, here's a full bootloader log:
OnePlus 6 bootloader logs
Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.XF.2.0-00364-SDM845LZB-1 S - IMAGE_VARIANT_STRING=SDM845LA S - OEM_IMAGE_VERSION_STRING=rd-build-73 S - Note XBL compiled at Jul 13 2021 21:56:54 S - Boot Interface: UFS S - Secure Boot: On S - Boot Config @ 0x00786070 = 0x000000c1 S - JTAG ID @ 0x00786130 = 0x2008b0e1 S - OEM ID @ 0x00786138 = 0x0051459b S - Serial Number @ 0x00784138 = 0x05662f97 S - Feature Config Row 0 @ 0x007841a0 = 0x0050200080000400 S - Feature Config Row 1 @ 0x007841a8 = 0xe000000000000040 S - Core 0 Frequency, 1516 MHz S - PBL Patch Ver: 1 S - PBL freq: 600 MHZ B - 94 - PBL, Start B - 5275 - bootable_media_detect_entry B - 44238 - bootable_media_detect_success B - 44613 - elf_loader_entry B - 45190 - auth_hash_seg_entry B - 52721 - auth_hash_seg_exit B - 58726 - elf_segs_hash_verify_entry B - 65502 - elf_segs_hash_verify_exit B - 66131 - auth_xbl_sec_hash_seg_entry B - 73338 - auth_xbl_sec_hash_seg_exit B - 73340 - xbl_sec_segs_hash_verify_entry B - 74093 - xbl_sec_segs_hash_verify_exit B - 74116 - PBL, End B - 88968 - SBL1, Start B - 205478 - boot_flash_init, Start D - 0 - boot_flash_init, Delta B - 209443 - xblconfig_init, Start D - 3782 - Auth Metadata D - 207552 - xblconfig_init, Delta B - 421967 - sbl1_ddr_set_default_params, Start D - 1494 - sbl1_ddr_set_default_params, Delta B - 429958 - boot_config_data_table_init, Start B - 434655 - CDT not programmed, using default D - 4575 - boot_config_data_table_init, Delta - (54 Bytes) B - 449143 - CDT Version:3,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0 B - 454846 - pm_device_init, Start B - 460092 - PM: PON REASON: PM0=0x800028000000080:0x40 PM1=0x400008000000020:0x0 PM2=0x400 B - 520177 - PM: SET_VAL:Skip D - 64873 - pm_device_init, Delta B - 523166 - pm_driver_init, Start D - 5337 - pm_driver_init, Delta B - 532072 - PM: Trigger FG IMA Reset B - 535641 - PM: Trigger FG IMA Reset.Completed B - 543052 - PM: [OnePlus]Print Oneplus ADC Config B - 544242 - PM: Name=GPIO_08 adc= 445 adc->id=2 B - 549061 - PM: Name=GPIO_09 adc= 444 adc->id=2 B - 553697 - PM: Name=GPIO_10 adc= 731 adc->id=3 B - 558333 - PM: Name=GPIO_11 adc= 445 adc->id=2 B - 562969 - PM: Name=GPIO_12 adc= 6 adc->id=1 B - 567025 - PM: hw_version = 22 name=PVT B - 571478 - PM: rf_version = 32 name=UNKNOWN B - 575535 - PM: init_a_board_version = 1 name=TMO B - 579896 - PM: enter console_loop time=579896 B - 1184772 - PM: exit console_loop time=1184772 B - 1185779 - PM: set_fast_charge_current=500 B - 1189439 - PM: set_pre_charge_current=250 B - 1193739 - PM: set_float_volt_mv=4365 B - 1197948 - PM: set_usbin_icl=2100 B - 1202737 - PM: EntryVbat: 4231; EntrySOC: -1 B - 1205299 - PM: ADSP result: 8 B - 1209752 - PM: APSD in progress B - 1213107 - PM: pm_sbl_chg_post_init B - 1216248 - PM: hw_version = 22 name=PVT B - 1219939 - PM: get_hw_version: 22 set RF_CLK2 4X B - 1223995 - vsense_init, Start D - 0 - vsense_init, Delta B - 1250927 - sbl1_ddr_set_params, Start B - 1252757 - Pre_DDR_clock_init, Start D - 91 - Pre_DDR_clock_init, Delta D - 7686 - sbl1_ddr_set_params, Delta B - 1262364 - sbl1_ddr_init, Start D - 16134 - sbl1_ddr_init, Delta B - 1282372 - DSF version = 253.10, DSF SHRM version = 173.3 B - 1285697 - Manufacturer ID = 1, Device Type = 7 B - 1291309 - Rank 0 size = 4096 MB, Rank 1 size = 4096 MB B - 1296341 - do_ddr_training, Start B - 1302929 - Frequency = 1355 MHz D - 3507 - do_ddr_training, Delta B - 1311561 - pImem Init Start D - 9729 - pImem Init End, Delta B - 1323212 - clock_init, Start D - 213 - clock_init, Delta B - 1328244 - Image Load, Start D - 6832 - Auth Metadata D - 244 - Segments hash check D - 13085 - APDP Image Loaded, Delta - (7828 Bytes) B - 1344684 - usb: UFS Serial - 5725c671 B - 1349594 - usb: fedl, vbus_low B - 1353956 - PM: 0: PON=0x80:KPDPWR_N: ON=0x80:PON_SEQ: POFF=0x2:PS_HOLD: OFF=0x8:RAW_DVDD_O B - 1362343 - PM: 1: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B - 1372561 - PM: 2: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B - 1379271 - PM: SMEM Chgr Info Write Success B - 1385096 - Image Load, Start D - 3507 - Auth Metadata D - 10187 - Segments hash check D - 20954 - AOP Image Loaded, Delta - (178864 Bytes) B - 1409283 - Image Load, Start D - 3477 - Auth Metadata D - 274 - Segments hash check D - 12139 - QSEE Dev Config Image Loaded, Delta - (34144 Bytes) B - 1430267 - Image Load, Start D - 10065 - Auth Metadata D - 11803 - Segments hash check D - 41907 - QSEE Image Loaded, Delta - (2038800 Bytes) B - 1475437 - Image Load, Start D - 152 - SEC Image Loaded, Delta - (4096 Bytes) B - 1483733 - Image Load, Start D - 3538 - Auth Metadata <code>oneplus-enchilada:~$ ls -lah /dev/disk/by-partlabel/ </code> D - 2440 - Segments hash check D - 18666 - QHEE Image Loaded, Delta - (391232 Bytes) B - 1505663 - Image Load, Start D - 5185 - STI Image Loaded, Delta - (0 Bytes) B - 1514081 - Image Load, Start D - 3447 - Auth Metadata D - 976 - Segments hash check D - 11285 - ABL Image Loaded, Delta - (203344 Bytes) B - 1528721 - Image Load, Start D - 3538 - Auth Metadata D - 9180 - Segments hash check D - 30469 - APPSBL Image Loaded, Delta - (2097152 Bytes) B - 1599847 - success: 1; magic: ; addr: 0x5c00000 B - 1599908 - SBL1, End D - 1515637 - SBL1, Delta S - Flash Throughput, 130000 KB/s (5027834 Bytes, 38631 us) S - DDR Frequency, 1353 MHz UEFI Start [ 1956] SEC ASLR : On DEP : On Timer Delta : +0 mS RAM Entry 0 : Base 0x0000000080000000 Size 0x0000000100000000 RAM Entry 1 : Base 0x0000000180000000 Size 0x00000000FC8A0000 UEFI Ver : 5.0.210713.BOOT.XF.2.0-00364-SDM845LZB-1 Build Info : 64b Jul 13 2021 21:57:20 Boot Device : UFS PROD Mode : TRUE Retail : TRUE [OpBootloaderLog] Start 13 10 [OpBootloaderLog] Start init bootloader log service [OpBootloaderLog] Already init [OpBootloaderLog] BootCount is 10551 [EFI_D_ERROR] bootloader boot count 10551 times [OpBootloaderLog] Replace segment 10 [OpBootloaderLog] find free segment is 10 PM0: 20, PM1: 21, PM2: 24, Elapsed tick: 0x2919968, Wait tick: 0x2DC6C00 Elapsed tick: 0x2A041EE, Wait tick: 0x2DC6C00 Elapsed tick: 0x2AEEBCE, Wait tick: 0x2DC6C00 Elapsed tick: 0x2BD95B7, Wait tick: 0x2DC6C00 Elapsed tick: 0x2CC3F5C, Wait tick: 0x2DC6C00 Elapsed tick: 0x2DAE8F1, Wait tick: 0x2DC6C00 [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs PanelId--read the LCD register 0xDA the ID1 = :0x0000AD PanelId--read the LCD register 0xDB the ID2 = :0x00000A PanelId--read the LCD register 0xDC the ID3 = :0x000005 PanelId:0xAD0A05 DisplayDxe: Resolution 1080x2280 (1 intf) [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs ----------------------------- Platform Init [ 3129] BDS qWrite addr:0x0 data:0x1 write addr:0x0 error L:0x21 H:0x4 FG TYPE= 0x421 fg_type:0x421 HW_ID:22 BatteryNotMatch--- = 0 KeyPressed=1 Status=0 key_boot_mode=0x2 WrongBatteryShutdown enter WrongBatteryShutdown enterBatteryNotMatch=0 Platform : MTP Chip Name : SDM845 Chip Ver : 2.1 Core 0 Freq: 1612 MHz ----------------------------- UEFI Total : 2901 ms POST Time [ 4857] OS Loader Loader Build Info: May 11 2021 22:56:21 [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs LoadSecureApps: Load app from partition(keymaster): Status = 0x0, AppId = 1 VB: RWDeviceState:READ_CONFIG status=0 read_rsp.status=0 secure_device=1 VB: RWDeviceState: Succeed using rpmb! Device support param encryption. enc_header->magic = A0AD646A, ENCRYPTED_MAGIC = A0AD646A SID 300 is encrypted check_enc_block_and_fix: Verify SID 300 Success enc_header->magic = A0AD646A, ENCRYPTED_MAGIC = A0AD646A SID 304 is encrypted check_enc_block_and_fix: Verify SID 304 Success migrate_custflag_from_plaintext[00000131] Start cust flag migration check [get_param_by_index_and_offset] sid_index = 304 offset = 164 buf = 9984CFD4 length = 4 Encrypted block 304 is verified success migrate_custflag_from_plaintext[00000139] Cust flag has been migrated, no need to do further!
- The bootloader supports selecting the "best match" from multiple DTBs (all appended to the kernel), this is also true for the PocoPhone F1 and makes it possible to use a single boot image across both devices. The OnePlus 6T seems to select the enchilada DTB before it's own though.
See if appending the fajita DTB before the enchilada one will cause it to be selected first. |
- ABL logs will also be printed via UART, however XBL / SBL logs are only printed if you hook up the Rx line (pulling it high to 1.8v should be enough for this).
- Qualcomm's public ABL sources can offer a lot of insight here, there is a lot of potential for fuzzing by messing with the partition table and various image headers. https://source.codeaurora.org/quic/la/abl/tianocore/edk2/tree/QcomModulePkg?h=LA.UM.9.3.r1-01500-sdm845.0
I haven't worked out which commit matches the ABL which is actually on device. |