luxferre/lexipwn
1
0
Fork 0
Code Actions Releases 1 Activity

readme upd

Browse Source
This commit is contained in:
Luxferre
2025-03-01 10:30:40 +02:00
parent 70d942dc06
commit fa1c7c45f2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -105,7 +105,7 @@ The devinfo partition essentially consists of three areas: information header ar
However, any production-grade Pixel has an IMEI integrity protection mechanism built into its (Exynos-based) modem firmware. An internal SHA256 checksum (based upon the values of both IMEI numbers and probably something else) is stored in the `persist` partition, in the `/mnt/vendor/persist/modem/cpsha` file in its ASCII form. If any of the IMEI values stored in the devinfo partition do not match this hash, the modem will report all zeroes for both IMEIs to the screen and to the network. Early Pixel models like 6 and 6 Pro allowed to bypass this check by lowering the board stage code in the devinfo header area, but this didn't work in the later generations. In order to properly fix this CPSHA file, the calculation request must be made to the modem itself, which can be done via the `AT+GOOGGETIMEISHA` command and manually copying its output to the above path. This command, however, can only work if the phone itself is booted into the factory mode, which in turn can be achieved by modifying the corresponding devinfo PS area tag called `bootmode` by setting it from `normal` to `factory` and a subsequent reboot.
The last question to clarify is how the AT commands can be run on the Pixel devices. Unfortunately, the only interface that's currently known there is by writing to and reading from the `/dev/umts_router` file, which is not even a proper serial device and cannot be interacted with by the means of `microcom` or other serial terminal software. The AT commands are written one by one to this file, then the responses are read back from it. Not all commands respond immediately though, so sometimes we just don't know when to expect the respnonse. For the purpose of just running `AT+GOOGGETIMEISHA`, lexipwn doesn't implement any response heuristics and only returns the output that it can read immediately, which is fine with this particular AT command. For the sake of completeness, the functionality of running any single-line AT command is also implemented in the program.
The last question to clarify is how the AT commands can be run on the Pixel devices. Unfortunately, the only interface that's currently known there is by writing to and reading from the `/dev/umts_router` file, which is not even a proper serial device and cannot be interacted with by the means of `microcom` or other serial terminal software. The AT commands are written one by one to this file, then the responses are read back from it. Not all commands respond immediately though, so sometimes we just don't know when to expect the response. For the purpose of just running `AT+GOOGGETIMEISHA`, lexipwn doesn't implement any response heuristics and only returns the output that it can read immediately, which is fine with this particular AT command. For the sake of completeness, the functionality of running any single-line AT command is also implemented in the program.
Using all this knowledge, you can now freely create your own devinfo manipulation tool if you don't like lexipwn for any reason.