F5/A83 "NEW" security O_o - Page 2 - GSM-Forum

ORITECH · 11-28-2018, 10:39

Quote:

Originally Posted by JayDi

There is nothing release according this. Will share TP info by requests.

please sir a83 on my hand
TP asap please

JayDi · 11-28-2018, 10:45

Quote:

Originally Posted by rebainoor

Yes correct this important to know how SLA challenge work to authorize boot !

Easy, device sends RID and unique data to sign, then wait to signed block back and verify it by public_key.

JayDi · 11-28-2018, 11:02

Not have anything good to make shoot.
Device disassembly require nothing, just remember about need start NOT from screen corner, but after it. Around sccreen corner plastic frame.

After remove screws will void warranty. You had been warned.

Remove battery connector, short TP, insert cable. After device connect - remove short.

JayDi · 11-28-2018, 11:04

BTW - seems as OPPO using/start using EFUSE to avoid downgrade - yes, like QLM! At first look

You can flash older SW preloader, it will enter in brom loop, until new version will not be flashed.

rebainoor · 11-28-2018, 11:12

Quote:

Originally Posted by JayDi

Easy, device sends RID and unique data to sign, then wait to signed block back and verify it by public_key.

but it not easy if its easy for what use TP
can you contact me by skype Mr JayDi

dany_boy · 11-28-2018, 12:01

(Remove battery connector, short TP, insert cable. After device connect - remove short. )

after device conect need to place battery again to do some opreation for flash or format . ? or its work without battery

mcclinic · 11-28-2018, 12:32

Quote:

Originally Posted by dany_boy

(Remove battery connector, short TP, insert cable. After device connect - remove short. )

after device conect need to place battery again to do some opreation for flash or format . ? or its work without battery

Without Battery, TP With Battery Always Risky, Maybe can Motherboard Short.

pshycoboy · 11-28-2018, 12:42

and now how to boot this phone without TP ?

bronce · 11-28-2018, 12:54

Quote:

Originally Posted by JayDi

There is nothing release according this. Will share TP info by requests.

can you PLS. share/give me TP info pls...

tia,

JayDi · 11-28-2018, 13:29

Quote:

Originally Posted by mcclinic

Without Battery, TP With Battery Always Risky, Maybe can Motherboard Short.

Quote:

Originally Posted by pshycoboy

and now how to boot this phone without TP ?

Quote:

Originally Posted by bronce

can you PLS. share/give me TP info pls...

tia,

Every TP procedure is potentially dangerous.
So better not use, or use at own risk. Also, better use some resistor for better short circuit protection.

babarmughal · 11-28-2018, 13:29

Quote:

Originally Posted by JayDi

Code:

Load IDBase v111571 Ok!

Update configuration ... 
Update Ok!
Load IDBase v112373 Ok!

Operation : Identify [ v2.02 ]

1. Make sure device is powered off. Power off, if need. Wait 20 seconds after
2. Insert USB cable in phone
Waiting for device connection ...

PTFN : DA USB VCOM Port (COM12)
MODE : PRELOADER PORT
PORT : 12
Waiting BOOT ack ...
PRELOADER : ACK confirmed!
BROM : Init BROM
BROM init passed!
     CHIP : MT6763 , SBID : 0x8A00 , HWVR : 0xCA01 , SWVR : 0x0001
     TYPE : MODERN RAPHAEL
BROM : SecLevel : 0x00000005
BROM : SecMode  : SBC+SDA
BROM : PRELOADER PORT
MODE : Oppo : F5 | Manual : Disabled
AGENT : Look for suitable BootChain in DA ... 
AGENT : DA_PL_CRYPTO.bin
AGENT : Found MT6763
AGENT : MTK_DOWNLOAD_AGENT
     BROM : Sending 1st DA ...

  BROM  : 0x00002001 : DA SEND ERROR!
  ERROR : SECURE BOOT : MISMATCH BOOT SIGNATURE!
  INFO : PRELOADER Level : CORRECT DA required : PL/PL_CRYPTO

Error : Fail to init protocol!
Remove battery, cable. Check cable/connection/driver! Check SW hint! Repeat operation!

Reconnect Power/Cable!

Code:

Operation : Identify [ v2.02 ]

1. Make sure device is powered off. Power off, if need. Wait 20 seconds after
2. Insert USB cable in phone
Waiting for device connection ...

PTFN : MediaTek USB Port (COM6)
MODE : BOOTROM
PORT : 6
Waiting BOOT ack ...
BROM : Skip ACK verify
BROM : Init BROM
BROM init passed!
     CHIP : MT6763 , SBID : 0x8A00 , HWVR : 0xCA01 , SWVR : 0x0001
     TYPE : MODERN RAPHAEL
BROM : SecLevel : 0x000000E5
BROM : SecMode  : SBC+SDA+SEL
BROM : BOOTROM
MODE : Oppo : F5 | Manual : Disabled
BROM : SLA
BROM : SLA Passed!
AGENT : Look for suitable BootChain in DA ... 
AGENT : DA_PL_CRYPTO.bin
AGENT : Found MT6763
AGENT : MTK_DOWNLOAD_AGENT
     BROM : Sending 1st DA ...
BROM : DA sent
BROM :Transfer control to DA ... 
     DA : AGENT started!
DA : SYNC
     DA : MODE : BROM
DA : EXT_RAM NOT initialized!
     EMI : DEV : MT6763
     EMI : SRC : preloader_oppo6763_17031.bin
     EMI : CNT : 000F
     EMI : [00] : DRAM : EXTERNAL DRAM [LP/DDR4] , UNDEFINED : VEN : UNKNOWN   | DEV :  : RAM : [ 0 B ]
     EMI : [01] : eMCP : eMMC+LP/DDR4 , ID : 150100444836444D42 : VEN : SAMSUNG   | DEV : DH6DMB : RAM : [ 4,00 GB ]
     EMI : [02] : eMCP : eMMC+LP/DDR3 , ID : 150100525836344D42 : VEN : SAMSUNG   | DEV : RX64MB : RAM : [ 4,00 GB ]
     EMI : [03] : eMCP : eMMC+LP/DDR3 , ID : 150100524836344142 : VEN : SAMSUNG   | DEV : RH64AB : RAM : [ 4,00 GB ]
     EMI : [04] : eMCP : eMMC+LP/DDR4 , ID : 150100334836434D42 : VEN : SAMSUNG   | DEV : 3H6CMB : RAM : [ 6,00 GB ]
     EMI : [05] : eMCP : eMMC+LP/DDR3 , ID : 150100524836344D42 : VEN : SAMSUNG   | DEV : RH64MB : RAM : [ 4,00 GB ]
     EMI : [06] : eMCP : eMMC+LP/DDR3 , ID : 150100474436424D42 : VEN : SAMSUNG   | DEV : GD6BMB : RAM : [ 3,00 GB ]
     EMI : [07] : eMCP : eMMC+LP/DDR3 , ID : 150100475836424D42 : VEN : SAMSUNG   | DEV : GX6BMB : RAM : [ 3,00 GB ]
     EMI : [08] : eMCP : eMMC+LP/DDR3 , ID : 150100474536424D42 : VEN : SAMSUNG   | DEV : GE6BMB : RAM : [ 3,00 GB ]
     EMI : [09] : eMCP : eMMC+LP/DDR3 , ID : 150100524436344D42 : VEN : SAMSUNG   | DEV : RD64MB : RAM : [ 4,00 GB ]
     EMI : [0A] : eMCP : eMMC+LP/DDR3 , ID : 13014E53304A394237 : VEN : MICRON    | DEV : S0J9B7 : RAM : [ 3,00 GB ]
     EMI : [0B] : DRAM : EXTERNAL DRAM [LP/DDR3] , UNDEFINED : VEN : UNKNOWN   | DEV :  : RAM : [ 4,00 GB ]
     EMI : [0C] : DRAM : EXTERNAL DRAM [LP/DDR4] , UNDEFINED : VEN : UNKNOWN   | DEV :  : RAM : [ 4,00 GB ]
     EMI : [0D] : DRAM : EXTERNAL DRAM [LP/DDR3] , UNDEFINED : VEN : UNKNOWN   | DEV :  : RAM : [ 3,00 GB ]
     EMI : [0E] : DRAM : EXTERNAL DRAM [LP/DDR4] , UNDEFINED : VEN : UNKNOWN   | DEV :  : RAM : [ 6,00 GB ]
     EMI : Init EMI from PRELOADER
     EMI : EXT_RAM CFG Passed!
DA : BOOT to 2nd DA ...
DA : 2ND stage confirmed!
DA : SYNC with DA passed!
DA : Receiving HW info

        SRAM: 0x00040000 [ 256,00 KB ]
        DRAM: 0xC0000000 [ 3,00 GB ]

        EMMC: 90014A484247346132A529661C37A433
        EMMC: VEN : HYNIX | OEM : 4A01 | DEV : HBG4a2
        EMMC: 
              BOOT1  : 0x00400000 [ 4,00 MB ]
              BOOT2  : 0x00400000 [ 4,00 MB ]
              RPMB   : 0x00400000 [ 4,00 MB ]
              USER   : 0x747C00000 [ 29,12 GB ]

        CHIP : MT6763 , SBID : 0x8A00 , HWVR : 0xCA01 , SWVR : 0x0000 , EVOL : 0x0000

        RNID : D25C131EFC1EE670F939CD2FCB809311

DA : USB : HIGH-SPEED

Boot done!

Patch Level    : N6F26Q
Ver. CodeName  : REL
Ver. Release   : 7.1.1
Sec. Patch     : 2018-10-05
Build Time     : 1539797161
Product Manfct : OPPO
Board Platform : mt6763
Product Model  : OPPO CPH1723
Product Brand  : OPPO
Product Name   : CPH1723
Product Device : M6763A
Product Board  : full_oppo6763_17031
Product Info   : oppo6763_17031
SW Version     : A.30
SW OTA Version : M6763A_11.A.30_0300_201810172338
SW OTA Name    : CPH1723EX_11_A.30_181017
Display ID     : CPH1723EX_11_A.30_181017
Kernel Info    : 4.4.22-G201810172338

USERDATA : ENCRYPTED 


Done!
Elapsed: 00:00:21

i understand... thank you JayDi bro for this

JayDi · 11-28-2018, 13:29

Quote:

Originally Posted by pshycoboy

and now how to boot this phone without TP ?

With factory tools access. There some peoples selling service for it around. Have no idea.

ORITECH · 11-28-2018, 13:39

Quote:

Originally Posted by JayDi

Every TP procedure is potentially dangerous.
So better not use, or use at own risk. Also, better use some resistor for better short circuit protection.

done format oppo a83. thank a lot mr jaydi

chezzter · 11-28-2018, 13:45

Quote:

Originally Posted by ORITECH

done format oppo a83. thank a lot mr jaydi

Show log info.. .............

dany_boy · 11-28-2018, 13:50

Quote:

Originally Posted by JayDi

Every TP procedure is potentially dangerous.
So better not use, or use at own risk. Also, better use some resistor for better short circuit protection.

which resistor is better to use . i mean k power

11-28-2018, 11:04	#19 (permalink)
JayDi No Life Poster Join Date: Mar 2007 Location: Where you live Posts: 18,542 Member: 462970 Status: Offline Thanks Meter: 20,352	BTW - seems as OPPO using/start using EFUSE to avoid downgrade - yes, like QLM! At first look You can flash older SW preloader, it will enter in brom loop, until new version will not be flashed.

11-28-2018, 12:01	#21 (permalink)
dany_boy No Life Poster Join Date: Jul 2013 Location: Pakistan. Rahim Yar Khan Posts: 1,661 Member: 1977629 Status: Offline Thanks Meter: 429	(Remove battery connector, short TP, insert cable. After device connect - remove short. ) after device conect need to place battery again to do some opreation for flash or format . ? or its work without battery

11-28-2018, 12:42	#23 (permalink)
pshycoboy Freak Poster Join Date: Jun 2011 Location: ilution Posts: 344 Member: 1597314 Status: Offline Thanks Meter: 116	and now how to boot this phone without TP ?