{"id":23,"date":"2026-09-12T13:58:08","date_gmt":"2026-09-12T05:58:08","guid":{"rendered":"https:\/\/blog.liang.wmy2026.cn\/?p=23"},"modified":"2026-09-12T13:58:08","modified_gmt":"2026-09-12T05:58:08","slug":"23","status":"publish","type":"post","link":"https:\/\/blog.liang.wmy2026.cn\/?p=23","title":{"rendered":""},"content":{"rendered":"

OPPO A11 (SDM665) \u5f15\u5bfc\u6f0f\u6d1e\u6316\u6398\u4e0e\u5b8c\u6574\u590d\u73b0<\/h1>\n

\n \u4f5c\u8005\uff1a\u9ece\u6602\uff08\u4e0d\u662f\u83dc\u9e21\u5440\uff09 \u00b7 \u65f6\u95f4\uff1a2026
\n \u53c2\u8003\u65b9\u6cd5\u8bba\uff1ah4ckm310n\u300a\u89e3\u9501Vivo Y31S\u300b(https:\/\/h4ckm310n.com\/?p=106) \u2014\u2014 USB \u6293\u5305 + \u9006\u5411 + \u5b57\u8282\u7ea7\u590d\u73b0\n<\/p><\/blockquote>\n

\n

\u6458\u8981<\/h2>\n

\u672c\u5de5\u5177\u7684\u76ee\u6807\u53ea\u6709\u4e00\u4ef6\u4e8b\uff1a\u628a\u4e00\u9897\u672a\u7ecf\u5b98\u65b9\u7b7e\u540d\u7684 programmer \u5f15\u5bfc\u955c\u50cf\uff0c\u901a\u8fc7 9008 \u6a21\u5f0f\u6ce8\u5165 OPPO A11 (\u9ad8\u901a SDM665) \u7684 PBL\uff0c\u8ba9\u8bbe\u5907\u8fdb\u5165 Firehose<\/strong>\u3002<\/p>\n

\u6574\u4e2a\u7814\u7a76\u7b49\u4ef7\u4e8e\"\u628a UnlockTool \u89e3\u9501\u4e00\u6761\u624b\u673a\u7684\u8def\uff0c\u7528\u516c\u5f00\u7684\u6293\u5305 + \u9006\u5411 + \u5b57\u8282\u7ea7\u8fd8\u539f<\/strong>\u4e09\u6b65\u590d\u523b\u4e00\u904d\"\uff0c\u4e0e\u4f60\u53c2\u8003\u7684 h4ckm310n \u89e3\u9501 Vivo \u662f\u540c\u4e00\u5957\u65b9\u6cd5\u8bba\uff0c\u53ea\u4e0d\u8fc7\u6211\u4eec\u628a\u76ee\u6807\u653e\u5230\u4e86\u66f4\u5e95\u5c42\u7684\u5f15\u5bfc\u56fa\u4ef6<\/strong>\u4e0a\u3002<\/p>\n

\u6d89\u53ca\u7684\u6280\u672f\u8981\u70b9\uff1a
\n1. Qualcomm PBL \/ Sahara<\/strong>\uff089008\uff09\u5f15\u5bfc\u534f\u8bae
\n2. \u5bf9 PBL \u72b6\u6001\u673a\u7684\u4e00\u4e2a \u6f0f\u6d1e\u5229\u7528<\/strong>\uff1a\u8fde\u7eed 13 9A 9A 9A<\/code> \u00d7 95
\n3. Firehose XML \u534f\u8bae + UFS<\/strong> \u914d\u7f6e
\n4. \u4e00\u4e2a\u8e29\u4e86\u5927\u534a\u5929\u7684\u5b57\u8282\u7ea7\u5927\u5751<\/strong>\uff1a\u955c\u50cf\u67d0 4 \u5b57\u8282\u635f\u574f\u5bfc\u81f4 PBL \u9759\u9ed8\u62d2\u7edd<\/p>\n

\n

1. \u80cc\u666f\u4e0e\u52a8\u673a<\/h2>\n

1.1 \u4e3a\u4ec0\u4e48\u4e0d\u80fd\u76f4\u63a5\u5237\u5f15\u5bfc<\/h3>\n

OPPO A11\uff08SDM665\uff09\u8981\u5f15\u5bfc\u7cfb\u7edf\u3001\u8981\u89e3\u9501\uff0c\u7ed5\u4e0d\u5f00\u5b98\u65b9\/\u5382\u5546\u5de5\u5177\uff08UnlockTool \u7b49\uff09\u3002\u6b63\u89c4\u8def\u5f84\u91cc\uff0cprogrammer\uff08\u5f15\u5bfc\u52a0\u8f7d\u5668\uff09\u662f\u5e26\u7b7e\u540d\u6821\u9a8c\u7684<\/strong>\uff0cPBL \u6821\u9a8c\u4e0d\u8fc7\u5c31\u62d2\u7edd\u8df3\u8f6c\u3002<\/p>\n

1.2 \u601d\u8def<\/h3>\n

\u76f4\u63a5\u4f7f\u7528\u5de5\u5177\u7684\u6d41\u91cf\u505a\u9ed1\u76d2\u590d\u73b0<\/strong>\uff1a
\n- \u8ba9\u5de5\u5177\uff08UnlockTool\uff09\u6267\u884c\u4e00\u6b21\"\u8fdb Firehose\"\uff1b
\n- \u5728 USB \u5c42\u6293\u5230\u5b83\u548c\u8bbe\u5907\u4e4b\u95f4\"\u53d1\u51fa\u53bb \/ \u6536\u56de\u6765\"\u7684\u6bcf\u4e00\u4e2a\u5b57\u8282\uff1b
\n- \u628a\u8fd9\u4e9b\u6d41\u91cf\u5728\u6211\u4eec\u81ea\u5df1\u7684\u811a\u672c<\/strong>\u91cc\u91cd\u653e\uff0c\u9010\u5b57\u8282\u4e00\u6bd4\u4e00\u8fd8\u539f\u3002<\/p>\n

\u8fd9\u4e0e h4ckm310n \u7528 pyusb \u6a21\u62df fastboot \u5bf9 Vivo \u53d1\u5305<\/strong>\u662f\u540c\u4e00\u4e2a\u9053\u7406\u2014\u2014\u53ea\u4e0d\u8fc7\u4ed6\u590d\u73b0\u7684\u662f fastboot \u547d\u4ee4\uff0c\u6211\u4eec\u590d\u73b0\u7684\u662f Sahara\/PBL \u5f15\u5bfc\u534f\u8bae<\/strong>\u3002<\/p>\n

1.3 \u6293\u5305\u7684\u4e09\u4e2a\u89d2\u8272<\/h3>\n\n\n\n\n\n\n\n
\u89d2\u8272<\/th>\n\u4f5c\u7528<\/th>\n<\/tr>\n<\/thead>\n
\u624b\u673a\uff08\u771f\u673a\uff09<\/td>\n\u771f\u6b63\u7684\u53d7\u5bb3\u8005\uff0c\u8dd1\u7684\u662f\u9ad8\u901a 9008 \u5f15\u5bfc<\/td>\n<\/tr>\n
UnlockTool.exe\uff08\u9006\u5411\u6837\u672c\uff09<\/td>\n\u6211\u4eec\u6293\u5305\u89c2\u5bdf\u7684\"\u6b63\u7248\u884c\u4e3a\"<\/td>\n<\/tr>\n
\u76d1\u542c\u5c42\uff08Frida hook + com0com \u865a\u62df\u4e32\u53e3 tap\uff09<\/td>\n\u628a UnlockTool\u2194\u624b\u673a\u4e4b\u95f4\u6240\u6709\u5b57\u8282\u955c\u50cf\u4e00\u4efd<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u6211\u4eec\u6700\u7ec8\u62ff\u5230\u4e86 614,491 \u5b57\u8282<\/strong>\u7684\u771f\u673a\u53cc\u5411\u6d41\u91cf\uff08tap_dev.bin<\/code> \u8bbe\u5907\u4fa7 + tap_un.bin<\/code> \u5de5\u5177\u4fa7\uff09\uff0c\u540e\u9762\u7684\u6240\u6709\u7ed3\u8bba\u90fd\u4ece\u8fd9\u4efd\u9ec4\u91d1\u6570\u636e\u91cc\u53cd\u63a8\u51fa\u6765\u3002<\/p>\n

\n

2. \u76ee\u6807\u4e0e\u6f0f\u6d1e\u9762\uff1aQualcomm PBL \/ Sahara<\/h2>\n

2.1 9008 = EDL\uff08Emergency Download Mode\uff09<\/h3>\n

SDM665 \u957f\u6309\u3010\u97f3\u91cf+\u3011+\u3010\u97f3\u91cf-\u3011\u63d2\u5165 USB \u4f1a\u8fdb\u5165 9008\u3002\u6b64\u65f6 PBL \u8dd1\u4e00\u4e2a\u53eb Sahara<\/strong> \u7684\u534f\u8bae\uff0c\u7b49\u5f85\u4e0a\u4f4d\u673a\u53d1 programmer\u3002<\/p>\n

2.2 Sahara \u62a5\u6587\uff0864 \u4f4d\u6a21\u5f0f\uff09<\/h3>\n

Sahara \u6bcf\u4e2a\u5305\u9996 8 \u5b57\u8282\u56fa\u5b9a\u4e3a cmd(4) + length(4)<\/code>\uff08\u5c0f\u7aef\uff09\u3002\u672c\u4e3b\u89d2\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n
\u542b\u4e49<\/th>\n\u547d\u4ee4\u7801<\/th>\n\u8bf4\u660e<\/th>\n<\/tr>\n<\/thead>\n
HELLO_REQ\uff08\u8bbe\u5907\u2192\u4e0a\u4f4d\u673a\uff09<\/td>\n0x01<\/code><\/td>\n48 \u5b57\u8282\uff1a01 00 00 00 30 00 00 00 02 00 00 00 01 00 00 00 \u2026<\/code>\uff0c\u5185\u542b max_cmd_len=0x400<\/code><\/td>\n<\/tr>\n
HELLO_RSP\uff08\u4e0a\u4f4d\u673a\u2192\u8bbe\u5907\uff09<\/td>\n0x02<\/code><\/td>\n48 \u5b57\u8282\uff0c\u4fdd\u7559\u5b57\u6bb5\u5fc5\u987b\u5168 0<\/strong><\/td>\n<\/tr>\n
READ_DATA(64bit)<\/td>\n0x12<\/code><\/td>\n24 \u5b57\u8282\uff1a12 00 00 00 20 00 00 00<\/code> + image_id(8) + offset(8) + length(8)<\/code><\/td>\n<\/tr>\n
END_TRANSFER<\/td>\n0x04<\/code><\/td>\n04 00 00 00 10 00 00 00 \/ image_id(4) \/ status(4)<\/code>\uff1bstatus=0x0<\/code> \u8868\u793a\u63a5\u53d7<\/td>\n<\/tr>\n
DONE_REQ \/ DONE_RSP<\/td>\n0x05 \/ 0x06<\/code><\/td>\n\u4e0a\u4f4d\u673a\u786e\u8ba4\u201c\u4f20\u5b8c\u4e86\u201d\uff0cPBL \u56de DONE_RSP \u540e\u8df3\u8f6c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

2.3 Firehose\uff08programmer \u8d77\u6765\u4e4b\u540e\uff09<\/h3>\n

\u8fdb\u5165 Firehose \u540e\u53cc\u65b9\u7528 XML<\/strong> \u901a\u4fe1\uff1a
\n- <nop value=\"ping\"\/><\/code> \u2192 \u63a2\u6d3b
\n- <configure MemoryName=\"UFS\" MaxPayloadSizeToTargetInBytes=\"16384\"\/><\/code> \u2192 \u914d\u7f6e UFS<\/strong>
\n- \u5b9e\u6d4b UFS \/ sector=4096 \/ maxpayload=16384<\/code><\/p>\n

3. \u6f0f\u6d1e\u6316\u6398\u8fc7\u7a0b\uff08\u6316\u7684\u8fc7\u7a0b\uff09<\/h2>\n

3.1 \u7b2c\u4e00\u6b65\uff1a\u6293\u9ec4\u91d1\u6570\u636e<\/h3>\n

\u5728 UnlockTool \u771f\u6b63\u89e3\u9501\u4e00\u53f0\u771f\u673a\u65f6\uff0c\u7528 Frida hook + \u4e32\u53e3 tap \u628a\u53cc\u5411\u6d41\u91cf\u5168\u91cf\u955c\u50cf\u4e0b\u6765\uff08\u7ea6 61 \u4e07\u5b57\u8282\uff09\uff0c\u5f97\u5230\u4e24\u4efd\u6587\u4ef6\uff1a
\n- tap_dev.bin<\/code>\uff08\u8bbe\u5907\u2192\u5de5\u5177\uff09
\n- tap_un.bin<\/code>\uff08\u5de5\u5177\u2192\u8bbe\u5907\uff09<\/p>\n

\u8fd9\u4e24\u4efd\u662f\u6211\u4eec\u505a\u4e00\u5207\u9a8c\u8bc1\u7684\u552f\u4e00\u88c1\u5224<\/strong>\u3002<\/p>\n

3.2 \u7b2c\u4e8c\u6b65\uff1a\u9006\u5411\u72b6\u6001\u673a<\/h3>\n

\u5bf9 UnlockTool.exe<\/code> \u505a\u9759\u6001\u5206\u6790\uff0c\u5b9a\u4f4d\u5230 \u504f\u79fb 0x15726B0<\/code><\/strong> \u9644\u8fd1\u7684\u201c\u590d\u4f4d\/\u63e1\u624b\u201d\u903b\u8f91\uff0c\u786e\u8ba4\u4e86\u5b83\u7684\u884c\u4e3a\uff1a\u5148\u7528\u4e00\u4e2a magic \u5e8f\u5217<\/strong>\u51b2\u51fb PBL \u7684 Sahara\u201c\u672a\u7b7e\u540d\u955c\u50cf\u6821\u9a8c\u201d\u5f00\u5173\uff0c\u518d\u6309\u6b63\u5e38 Sahara \u63e1\u624b\u4e0a\u4f20 programmer\u3002<\/p>\n

3.3 \u7b2c\u4e09\u6b65\uff1a\u8fd8\u539f\u6f0f\u6d1e\u5229\u7528\uff08EXPLOIT\uff09<\/h3>\n

\u4ece\u9ec4\u91d1\u6570\u636e\u91cc\u6570\u51fa\uff0cUnlockTool \u5728\u63e1\u624b\u4e4b\u524d\u4f1a\u7cbe\u51c6\u5730\u53d1 95 \u6b21<\/strong> 4 \u5b57\u8282\uff1a<\/p>\n

13 9A 9A 9A\n\u2502     \u2514\u2500\u2500 \u586b\u5145 0x9A 9A 9A\n\u2514\u2500\u2500 Sahara CMD = 0x13\n<\/code><\/pre>\n
\u539f\u7406\u63a8\u6d4b<\/strong>\uff1a\u8fd9 95 \u4e2a\u201c\u51e0\u4e4e\u975e\u6cd5\u201d\u7684 Sahara \u5305\u628a PBL \u547d\u4ee4\u89e3\u6790\u5faa\u73af\u649e\u6210\u4e00\u4e2a\u8d8a\u754c\/\u8986\u76d6\u72b6\u6001\uff0c\u6700\u7ec8\u628a\u5185\u90e8 \u5df2\u63e1\u624b \/ \u5df2\u9a8c\u7b7e<\/code> \u4e24\u4e2a\u6807\u5fd7\u4f4d\u8986\u76d6\u6e05\u96f6<\/strong>\uff0c\u4f7f PBL \u8bef\u4ee5\u4e3a\u201c\u8fd9\u4e2a\u5f15\u5bfc\u5df2\u88ab\u9a8c\u8bc1\u8fc7\u201d\uff0c\u4e8e\u662f\u540e\u9762\u672a\u7b7e\u540d\u7684 programmer \u4e5f\u80fd\u88ab\u63a5\u53d7\u5e76\u8df3\u8f6c\u3002<\/p>\n
\n  \u8fd9\u4e00\u6b65\u6b63\u662f\u811a\u672c\u91cc\u770b\u5230\u7684\u7d2b\u8272\u300c\u6f0f\u6d1e\u5229\u7528 \/ PBL EXPLOIT\u300d\u6a2a\u5e45 + \u72ec\u7acb\u8fdb\u5ea6\u6761<\/strong>\u3002\n<\/p><\/blockquote>\n
3.4 \u7b2c\u56db\u6b65\uff1a\u8fd8\u539f READ_DATA \u65f6\u5e8f<\/h3>\n
PBL \u6309\u7a0b\u5e8f\u5934\u8868<\/strong>\u987a\u5e8f\u4e00\u4e2a\u6bb5\u4e00\u4e2a\u6bb5\u5730\u8981\u6570\u636e\uff0864 \u4f4d\u7248\u8bf7\u6c42\u91cc\u7ed9 image_id\/offset\/length<\/code>\uff09\u3002\u8fd8\u539f\u51fa umi_elf_1.elf<\/code> \u7684\u8bf7\u6c42\u5e8f\u5217\uff1a<\/p>\n
0x0 \u2192 0x40(0x3B8) \u2192 0x1000 \u2192 0x2000(0xCD8) \u2192 0x5AB70 \u2192 0x5BB70(0xEEC) \u2192 0x3000 \u2026\n\u2026 \u2192 0x906BC(0x1000)\n= 127 \u5757\uff0c\u5408\u8ba1 497,532 \u5b57\u8282\n<\/code><\/pre>\n
\u6ce8\u610f\u5b83\u4e0d\u662f\u987a\u5e8f\u8bfb\u6587\u4ef6<\/strong>\uff1a\u4e2d\u9014\u8df3\u5230 0x5AB70<\/code>\u30010x5BB70<\/code> \u8fd9\u79cd\u201c\u7a0b\u5e8f\u5934\u91cc\u767b\u8bb0\u7684\u6bb5\u5730\u5740\u201d\uff0c\u518d\u8df3\u56de 0x3000<\/code> \u7ee7\u7eed\u3002\u5b9e\u73b0\u65f6\u5fc5\u987b\u6309\u8bf7\u6c42\u91cc\u7ed9\u7684 offset \u4ece\u6587\u4ef6\u53d6<\/strong>\uff0c\u4e0d\u80fd\u60f3\u5f53\u7136\u987a\u5e8f\u53d1\u3002<\/p>\n
3.5 \u7b2c\u4e94\u6b65\uff1a\u5224\u65ad\u6210\u529f \/ \u6362\u955c\u50cf<\/h3>\n
    \n
  • \u4f20\u5b8c\u4e00\u4e2a\u955c\u50cf\uff0c\u8bbe\u5907\u56de END_TRANSFER status=0x0<\/code>\uff08\u63a5\u53d7\uff09\u6216 !=0<\/code>\uff08\u62d2\u7edd\uff09\u3002<\/li>\n
  • \u5de5\u5177\u6309 DevPrg trinket(\u63a2\u6d4b 6 \u5757) \u2192 umi_elf_1(\u771f programmer) \u2192 umi_elf_2(\u5907\u7528)<\/code> \u9010\u4e2a\u8bd5\u3002<\/li>\n
  • \u7b2c\u4e00\u4e2a DevPrg<\/code>\uff08= umi_elf_0<\/code>\uff0c599,436 \u5b57\u8282\uff09\u88ab\u8bf7\u6c42 6 \u5757\u5c31\u505c<\/strong>\u2014\u2014\u8fd9\u662f\u6b63\u5e38\u7684\u201c\u63a2\u6d4b\u76f8\u201d\uff0cUnlockTool \u6293\u5305\u91cc\u7b2c\u4e00\u6bb5\u4e5f\u540c\u6837\u662f 6 \u5757\uff0c\u7136\u540e\u518d\u53d1 HELLO_RSP \u6362\u7b2c\u4e8c\u4e2a\u955c\u50cf umi_elf_1<\/code>\u3002<\/li>\n<\/ul>\n
    3.6 \u7b2c\u516d\u6b65\uff1a\u8fdb Firehose + UFS<\/h3>\n
    umi_elf_1<\/code> \u88ab\u63a5\u53d7 \u2192 \u4e0a\u4f4d\u673a\u53d1 DONE_REQ \u2192 PBL \u56de DONE_RSP \u2192 \u8df3\u8f6c \u2192 \u8bbe\u5907\u8d77\u6765\u53d1 XML \u2192 ping<\/code> OK \u2192 configure UFS<\/code> OK\u3002<\/p>\n
    4. \u8e29\u8fc7\u7684\u5751\uff08\u8fd9\u4e9b\u5751\u6700\u503c\u94b1\uff09<\/h2>\n
    \u5751 1\uff1a\u6ce2\u7279\u7387\u592a\u4f4e\uff0c\u8bbe\u5907\u4f1a\u88ab\u590d\u4f4d<\/h3>\n
    \u9ed8\u8ba4 115200 \u592a\u6162\uff0c\u5f15\u5bfc\u8981\u51e0\u5341\u79d2\uff0cPBL \u7b49\u4e0d\u8010\u70e6\u5c31\u590d\u4f4d\uff08\u7535\u8111\u201c\u53ee\u549a\u201d\u4e00\u58f0 = USB \u91cd\u679a\u4e3e\uff09\u3002\u6539\u6210 3000000<\/strong>\u3002\u82e5\u8d70 USB \u901a\u9053\u5219\u6bcf\u4e2a 4096 \u5b57\u8282\u5757\u53ea\u9700 ~48ms\u3002<\/p>\n
    \u5751 2\uff1a\u6362\u955c\u50cf\u65f6\u7edd\u5bf9\u4e0d\u8981\u53d1 RESET_STATE_MACHINE<\/h3>\n
    \u65e9\u671f\u6bcf\u6b21\u6362\u955c\u50cf\u90fd\u8c03 cmd_reset_state_machine()<\/code>\u3002\u8fd9\u662f\u9519\u7684<\/strong>\uff1aUnlockTool \u6293\u5305\u91cc\u4ece\u6ca1\u6709\u8fd9\u6761\u547d\u4ee4\uff0c\u5b83\u7684\u5207\u6362\u5c31\u662f\u201c\u76f4\u63a5\u518d\u53d1\u4e00\u4e2a HELLO_RSP\u201d\u3002\u4e00\u590d\u4f4d\u5c31\u628a\u8bbe\u5907\u6253\u56de 9008\uff0c\u540e\u9762\u5168\u9519\u3002<\/p>\n
    \u5751 3\uff1aHELLO_REQ \u5fc3\u8df3 \u2260 \u5931\u8d25<\/h3>\n
    \u8bbe\u5907\u4f1a\u5468\u671f\u6027\u5730\u53d1 HELLO_REQ\uff08\u5fc3\u8df3\uff09\u3002\u4f20\u5b8c\u540e\u7b2c\u4e00\u4e2a\u8bfb\u5230\u7684\u82e5\u662f HELLO_REQ\uff0c\u4e0d\u4ee3\u8868\u5931\u8d25<\/strong>\u3002\u4e00\u5f00\u59cb\u201c\u770b\u5230\u7b2c\u4e00\u4e2a\u5305\u662f HELLO_REQ \u5c31\u5224\u88ab\u62d2\u3001\u6362\u955c\u50cf\u201d\u662f\u8bef\u5224\u3002\u6b63\u786e\u505a\u6cd5\uff1a\u8df3\u8fc7\u5fc3\u8df3\u3001\u7ee7\u7eed\u591a\u8bfb\u51e0\u8f6e<\/strong>\uff0c\u76f4\u5230\u62ff\u5230 END_TRANSFER<\/code> \u6216 XML\u3002<\/p>\n
    \u5751 4\uff1a\u6bcf\u4e2a READ_DATA \u54cd\u5e94\u5fc5\u987b\u201c\u4e00\u6b21\u6027\u5199\u5b8c\u201d<\/h3>\n
    Sahara 64 \u4f4d\u6a21\u5f0f\u7684\u6570\u636e\u6bb5\u662f\u88f8\u5b57\u8282<\/strong>\uff08\u65e0\u6bcf\u5305\u5934\uff09\u3002\u82e5\u5206 512 \u5b57\u8282\u5c0f\u5757\u53d1\uff0c\u540e\u7eed\u8bf7\u6c42\u4f1a\u9519\u4f4d\u3001PBL \u4f1a\u4e00\u76f4\u7b49\u3002\u5fc5\u987b write(\u6574\u5757 4096\/0x1000)<\/code>\u3002<\/p>\n
    \u5751 5\uff1aHELLO_RSP \u7684\u4fdd\u7559\u5b57\u6bb5\u5fc5\u987b\u5168 0<\/h3>\n
    48 \u5b57\u8282\u91cc\u9664\u4e86\u7248\u672c\/\u547d\u4ee4\uff0c\u5176\u4f59\u4fdd\u7559\u5b57\u6bb5\u586b\u975e 0\uff0cPBL \u4f1a\u62d2\u7edd\/\u89e3\u6790\u9519\u3002<\/p>\n
    \u5751 6\uff1amagic \u6b21\u6570\u5fc5\u987b\u7cbe\u786e 95<\/h3>\n
    \u5c11\u4e86\u72b6\u6001\u673a\u6ca1\u88ab\u51b2\u57ae\uff1b\u591a\u4e86\u53ef\u80fd\u628a PBL \u649e\u8fdb\u66f4\u9519\u7684\u72b6\u6001\u3002\u8981\u548c UnlockTool \u6293\u51fa\u6765\u7684 95 \u4e00\u81f4\uff08\u9ed8\u8ba4 --retries 95<\/code>\uff09\u3002<\/p>\n
    \u5751 7\uff08\u6700\u9690\u853d\uff09\uff1a\u955c\u50cf\u88ab\u63d0\u53d6\u65f6\u574f\u4e86 4 \u4e2a\u5b57\u8282<\/h3>\n
    \u75c7\u72b6<\/strong>\uff1a\u8bbe\u5907\u628a 127 \u5757 READ_DATA \u5168\u90e8\u7167\u5e38\u8981\u5b8c<\/strong>\uff08\u8bf7\u6c42\u5e8f\u5217\u4e0e UnlockTool \u6293\u5305\u9010\u6761\u4e00\u81f4\uff09\uff0c\u7136\u540e\u6b7b\u6d3b\u4e0d\u56de END_TRANSFER<\/strong>\uff08\u8868\u73b0\u4e3a\u201c\u65e0\u56de\u5e94\u201d\u6216\u590d\u4f4d\u6210 HELLO_REQ\uff09\u3002<\/p>\n
    \u5b9a\u4f4d\u65b9\u6cd5<\/strong>\uff08\u5b57\u8282\u7ea7\u9ec4\u91d1\u5bf9\u6bd4\uff09\uff1a
    \n1. \u4ece tap_dev.bin<\/code> \u62bd\u51fa\u5168\u90e8 156 \u4e2a READ_DATA \u8bf7\u6c42<\/strong>\uff1b
    \n2. \u53d6 umi_elf_1<\/code> \u76f8\uff08#6 \u8d77\uff1a0x0\/0x40\/0x1000\/0x2000\/0x5AB70\/0x5BB70<\/code>\uff09\uff0c\u6309\u987a\u5e8f\u628a\u6bcf\u4e2a\u8bf7\u6c42\u5bf9\u5e94\u7684\u6587\u4ef6\u5757\u62fc\u8d77\u6765 = 497,532 \u5b57\u8282<\/strong>\uff1b
    \n3. \u4e0e tap_un.bin<\/code> \u91cc UnlockTool \u5b9e\u9645\u53d1\u9001\u7684\u540c\u4e00\u6bb5\u6570\u636e\u9010\u5b57\u8282\u6bd4\u5bf9\uff1b
    \n4. \u5168\u7a0b\u53ea\u5dee 4 \u4e2a\u5b57\u8282<\/strong>\uff1a<\/p>\n\n\n\n\n\n
    \u4f4d\u7f6e<\/th>\n\u6211\u4eec\u7684 umi_elf_1.elf<\/code><\/th>\nUnlockTool \u5b9e\u9645\u53d1\u9001<\/th>\n<\/tr>\n<\/thead>\n
    \u6587\u4ef6\u504f\u79fb 0x48B5E<\/code><\/td>\n0F 77 B5 AC<\/code><\/td>\n00 14 71 00<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
    \u6839\u56e0<\/strong>\uff1aPBL \u5bf9\u6574\u6bb5\u505a\u5b8c\u6574\u6027\u6821\u9a8c\uff0c\u8fd9 4 \u5b57\u8282\u9519\u4e86\u2192\u6821\u9a8c\u4e0d\u8fc7\u2192\u62d2\u7edd\u8df3\u8f6c\u4f46\u4e0d\u62a5\u9519<\/strong>\uff08\u9759\u9ed8\uff09\u3002\u628a 0x48B5E<\/code> \u6539\u6210 00 14 71 00<\/code> \u540e\uff0c\u8bbe\u5907\u7acb\u523b END_TRANSFER status=0x0<\/code> \u2192 Firehose \u2192 UFS \u914d\u7f6e\u6210\u529f\u3002<\/p>\n
    \u6559\u8bad<\/strong>\uff1a\u62ff\u5230\u4efb\u4f55 vendor \u63d0\u53d6\u7684\u955c\u50cf\uff0c\u90fd\u8981\u7528\u5b98\u65b9\u6d41\u91cf\u505a\u5b57\u8282\u7ea7\u5bf9\u7167<\/strong>\uff0c\u800c\u4e0d\u662f\u53ea\u770b\u201c\u80fd\u4e0d\u80fd\u4e0b\u8f7d\u201d\u3002edl_a11.py<\/code> \u5df2\u5185\u7f6e\u81ea\u52a8\u4fee\u6b63\uff08KNOWN_FIXES<\/code>\uff0c\u5148\u5907\u4efd .orig<\/code>\uff09\u3002<\/p>\n
    \u5751 8\uff1a\u955c\u50cf\u8eab\u4efd<\/h3>\n
      \n
    • DevPrg_Oppo_A11X_SDM665.trinket.elf<\/code> \u4e0e umi_elf_0.elf<\/code> \u662f\u540c\u4e00\u4e2a\u6587\u4ef6<\/strong>\uff08sha256 \u76f8\u540c\uff09\u3002<\/li>\n
    • \u7b2c\u4e00\u76f8\u88ab\u8bf7\u6c42 6 \u5757\u5c31\u505c\u662f\u6b63\u5e38\u63a2\u6d4b\uff0c\u4e0d\u662f\u5931\u8d25\u2014\u2014\u4e0d\u8981\u56e0\u6b64\u6539\u903b\u8f91\u3002<\/li>\n<\/ul>\n
      5. \u5b8c\u6574\u590d\u73b0\u8fc7\u7a0b<\/h2>\n
      5.1 \u51c6\u5907\uff08\u76ee\u6807\u7535\u8111\uff0cWindows 64 \u4f4d\uff09<\/h3>\n
        \n
      • \u6574\u4e2a oppo665new<\/code> \u6587\u4ef6\u5939\u62f7\u8d1d\u8fc7\u53bb\uff08\u81ea\u5e26\u4fbf\u643a Python 3.11<\/strong>\uff0c\u4f9d\u8d56\u5df2\u88c5\uff0c\u65e0\u9700\u88c5 Python\uff09\u3002<\/li>\n
      • \u65b0\u7535\u8111\u9700\u5148\u88c5\u4e00\u6b21 Qualcomm 9008 \u4e32\u53e3\u9a71\u52a8<\/strong>\uff08\u88c5\u8fc7\u5c31\u4e00\u76f4\u751f\u6548\uff09\u3002<\/li>\n<\/ul>\n
        5.2 \u8ba9\u624b\u673a\u8fdb 9008<\/h3>\n
          \n
        1. \u624b\u673a\u62d4\u6389\u6570\u636e\u7ebf\u3001\u5173\u673a\uff1b<\/li>\n
        2. \u6309\u4f4f\u3010\u97f3\u91cf+\u3011\u548c\u3010\u97f3\u91cf-\u3011\u4e0d\u8981\u677e\uff1b<\/li>\n
        3. \u63d2\u5165 USB\uff1b<\/li>\n
        4. \u8bbe\u5907\u7ba1\u7406\u5668\u51fa\u73b0 Qualcomm HS-USB QDLoader 9008 (COMx)<\/code> \u5373\u6210\u529f\u3002<\/li>\n<\/ol>\n
          5.3 \u8dd1\u590d\u73b0<\/h3>\n
          \u53cc\u51fb \u542f\u52a8.bat<\/code><\/strong>\uff0c\u6216\u547d\u4ee4\u884c\uff1a<\/p>\n
          .\\py\\python.exe edl_a11.py boot\n<\/code><\/pre>\n
          \u56de\u8f66\u901a\u8fc7\u514d\u8d23\u58f0\u660e\u540e\uff0c\u4f9d\u6b21\u770b\u5230 5 \u6b65\uff1a<\/p>\n
          \u6b65\u9aa4 1\/5  \u73af\u5883\u4e0e\u7aef\u53e3         \uff08\u627e\u5230 COMx\uff09\n\u6b65\u9aa4 2\/5  \u8fdb\u5165 EDL \/ Sahara \u63e1\u624b\n\u6b65\u9aa4 3\/5  \u6f0f\u6d1e\u5229\u7528 \u00b7 PBL EXPLOIT [\u5371\u9669]   \u2190 \u7d2b\u8272\u6a2a\u5e45 + \u72ec\u7acb\u8fdb\u5ea6\u6761 (95\u00d713 9A 9A 9A)\n\u6b65\u9aa4 4\/5  \u5f15\u5bfc\u955c\u50cf\u53d1\u9001        \u2190 \u8fdb\u5ea6\u6761 [####] 50.2% 292KB\/581.7KB PBL \u5df2\u8bfb 4 \u5757\n\u6b65\u9aa4 5\/5  Firehose \u521d\u59cb\u5316\n<\/code><\/pre>\n
          5.4 \u6210\u529f\u5224\u636e<\/h3>\n
          sahara | [END] image_id=0xD status=0x0 (SAHARA_STATUS_SUCCESS)\n================================================================\n  \u5b8c\u6210!  \u8bbe\u5907\u5df2\u5728 Firehose   [UFS \u5df2\u914d\u7f6e: UFS \/ \u6247\u533a 4096 \/ \u6700\u5927\u5305 16384]\n================================================================\n<\/code><\/pre>\n
          5.5 \u53ef\u9009\uff1a\u81ea\u5df1\u518d\u6293\u4e00\u904d\u505a\u5bf9\u7167<\/h3>\n
          \u60f3\u81ea\u5df1\u9a8c\u8bc1\u201c\u5b57\u8282\u7ea7\u590d\u73b0\u201d\uff0c\u6309\u540c\u4e00\u65b9\u6cd5\u8bba\u518d\u505a\u4e00\u6b21\u6293\u5305\uff1a
          \n1. \u7528 Frida hook + com0com \u865a\u62df\u4e32\u53e3\u628a UnlockTool\u2194\u624b\u673a\u6d41\u91cf\u955c\u50cf\u6210 tap_dev.bin \/ tap_un.bin<\/code>\uff1b
          \n2. \u62bd\u51fa READ_DATA \u8bf7\u6c42\uff0c\u6309\u76f8\u91cd\u7ec4\u51fa 497,532 \u5b57\u8282\uff1b
          \n3. \u4e0e umi_elf_1.elf<\/code> \u9010\u5b57\u8282\u5bf9\u6bd4\uff0c\u5e94\u53ea\u6709 0x48B5E<\/code> \u8fd9 4 \u5b57\u8282\u5dee\u5f02\uff08\u5de5\u5177\u4f1a\u81ea\u52a8\u6539\u56de\uff09\uff1b\u5176\u4f59 0 \u5dee\u5f02<\/strong>\u3002<\/p>\n
          5.6 \u547d\u4ee4\u884c\u53c2\u6570<\/h3>\n
          .\\py\\python.exe edl_a11.py boot --com COM16       \u53ea\u8ba4\u8fd9\u4e2a\u4e32\u53e3\n.\\py\\python.exe edl_a11.py boot --loader xxx.elf  \u6307\u5b9a programmer\n.\\py\\python.exe edl_a11.py boot --no-exploit      \u8df3\u8fc7 95 \u6b21 magic\uff08\u4e0d\u63a8\u8350\uff09\n<\/code><\/pre>\n
          \n
          6. \u7ed3\u8bba<\/h2>\n
            \n
          • \u9ad8\u901a PBL\/Sahara \u72b6\u6001\u673a<\/strong>\u7684\u786e\u5b58\u5728\u53ef\u88ab 13 9A 9A 9A \u00d7 95<\/code> \u51b2\u57ae\u7684\u6821\u9a8c\u7f3a\u9677\uff0c\u4f7f\u672a\u7b7e\u540d programmer<\/strong> \u4e5f\u80fd\u88ab\u63a5\u53d7\u5e76\u8df3\u8f6c\u3002<\/li>\n
          • \u6293\u5305 + \u5b57\u8282\u7ea7\u5bf9\u7167<\/strong>\u662f\u590d\u73b0\u4e00\u5207\u5382\u5546\u5f15\u5bfc\u884c\u4e3a\u7684\u53ef\u9760\u624b\u6bb5\uff08\u4e0e h4ckm310n \u89e3 Vivo \u540c\u6e90\uff09\u3002<\/li>\n
          • \u672c\u5de5\u5177\u628a\u201c\u6316\u6d1e\u7ed3\u679c\u201d\u56fa\u5316\u6210\uff1a\u5f69\u8272\u5206\u6b65 + \u6f0f\u6d1e\u5229\u7528\u6807\u6ce8 + \u5f15\u5bfc\u8fdb\u5ea6\u6761 + \u81ea\u52a8\u4fee\u6b63\u5173\u952e 4 \u5b57\u8282 + UFS \u914d\u7f6e<\/strong>\uff0c\u62f7\u5230\u4efb\u610f 64 \u4f4d Windows \u7535\u8111\u53cc\u51fb\u5373\u7528\u3002<\/li>\n
          • \u6700\u6df1\u7684\u5751\u4e0d\u662f\u2018\u4e0d\u4f1a\u5199\u4ee3\u7801\u2019\uff0c\u800c\u662f\u2018\u955c\u50cf\u91cc 4 \u4e2a\u5b57\u8282\u9519\u4e86\u2019<\/strong>\u2014\u2014\u8fd9\u7c7b\u9759\u9ed8\u5931\u8d25\u5fc5\u987b\u9760\u9ec4\u91d1\u6570\u636e\u9010\u5b57\u8282\u5bf9\u6bd4\u624d\u80fd\u5b9a\u4f4d\u3002<\/li>\n<\/ul>\n
            7. \u53c2\u8003<\/h2>\n
              \n
            • h4ckm310n\u300a\u89e3\u9501Vivo Y31S\u300b\u2014\u2014 USB \u6293\u5305 + pyusb \u590d\u73b0\uff1ahttps:\/\/h4ckm310n.com\/?p=106<\/li>\n
            • \u771f\u5b9e\u6293\u5305\u6587\u4ef6\uff08\u7814\u7a76\u671f\u751f\u6210\uff0c\u53ef\u590d\u6838\uff09\uff1atap_dev.bin<\/code> \/ tap_un.bin<\/code><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
              OPPO A11 (SDM665) \u5f15\u5bfc\u6f0f\u6d1e\u6316\u6398\u4e0e\u5b8c\u6574\u590d\u73b0 \u4f5c\u8005\uff1a\u9ece\u6602\uff08\u4e0d\u662f\u83dc\u9e21\u5440\uff09 \u00b7 \u65f6\u95f4\uff1a2026 \u53c2\u8003\u65b9\u6cd5\u8bba\uff1ah4ckm3 …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-23","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=\/wp\/v2\/posts\/23","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=23"}],"version-history":[{"count":1,"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=\/wp\/v2\/posts\/23\/revisions"}],"predecessor-version":[{"id":24,"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=\/wp\/v2\/posts\/23\/revisions\/24"}],"wp:attachment":[{"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=23"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=23"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.liang.wmy2026.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=23"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}