# lexipwn: Tensor-based Google Pixel device info Swiss army knife

The **lexipwn** (pronounced as _lexi-pone_, derived from "pixel" backwards and "pwn") project is a fully free, open-source and universal tool to manipulate device-specific information for Tensor-based Google Pixel smartphones. It comes in two variants: a standalone CLI binary (`lexipwn`) developed in the `lexipwn-cli` subproject and a GUI APK package (`lexipwn.apk`) developed in the `lexipwn-gui` subproject, which has a hard dependency on `lexipwn-cli` (hence shipped in the same repo) and embeds the CLI binary for its own operation.

Both the CLI and GUI variants are written in Go 1.24.

**Root access is required to run the tool in either variant!** 

As of now, lexipwn should work on the following Google Pixel models (provided they are rooted): 6, 6 Pro, 6a, 7, 7 Pro, 7a, Fold, 8, 8 Pro, 9, 9 Pro, 9 Pro XL, 9 Pro Fold. Reports on the Pixel 10 series are still pending.

## Features

* Edit main PS tags in the devinfo partition
* Switch the boot mode (normal or factory)
* Fix IMEI CPSHA after editing devinfo (requires the phone to be booted in the factory mode)
* Randomize IMEIs and MACs based on TACs or other prefixes
* Run arbitrary single-line AT commands
* Fully offline operation, no internet necessary

## Building

The prebuilt binaries of lexipwn in both variants are available in the "Releases" section of the repo and you can download and use them right away. However, this is a tool designed to run under root privileges, and, for security reasons, it is highly recommended to build your own binaries from the source code whenever possible.

**Important note: `https://code.luxferre.top/luxferre/lexipwn.git` is the only original repo of lexipwn, there are no GitHub/GitLab/SourceHut/etc mirrors or other usernames or URLs unless explicitly stated otherwise in this readme and confirmed on the [Luxferre's](https://luxferre.top) web page! If building from a fork, always verify the source code change commits against the original repo to avoid any malware!**

### CLI variant

To build the CLI variant of lexipwn, you need to just have Make and Go 1.24 (or above) installed.
Run `make cli` from the repository root and you'll see the static ARM64 binary in the `out/lexipwn` file.

You can then push the binary to e.g. `/data/local/tmp` directory on the device and directly use it from the `su` shell in ADB or Termux.

You can also try and build the CLI variant of lexipwn on Termux itself.

### GUI variant

To build the GUI variant of lexipwn, you need to have Make, Go 1.24 (or above), [Android NDK](https://github.com/android/ndk/wiki#supported-downloads) and `fyne` command installed. The recommended `fyne` command version is 1.6.2 and above.

You can install the [Fyne toolkit](https://fyne.io/) using the following commands:

```
go get fyne.io/fyne/v2@latest
go install fyne.io/fyne/v2/cmd/fyne@latest
```

Additionally, you need to ensure that the `ANDROID_NDK_HOME` environment variable is pointing to the directory you have extracted the Android NDK to. In most Linux distributions, if you have installed the NDK system-wide, you can populate this variable with the following command:

```
export ANDROID_NDK_HOME=$(dirname $(realpath $(whereis ndk-build | cut -f 2 -d:)))
```

Then, just run `make` from the repository root and you'll see the Android APK package in the `out/lexipwn.apk` file that you can install on your rooted phone.
The very first build may take a rather long time because Fyne will download all missing framework dependencies.
Note that this process will also build the CLI binary, you don't need to do anything with it if you only need the GUI (the binary is embedded into the APK too).

Afterwards, you can connect your phone via ADB and install the package manually or just run `make install` which will do the same thing.

## Usage

### Editing devinfo partition (CLI)

* List available PS tags (output as `[type] TAB [tagname] TAB [tagvalue]`): `lexipwn listps`
* Change a PS tag type (only `DIUS` and `DIFR` are valid): `lexipwn setpstype [tagname] [DIUS|DIFR]`
* Change PS tag values (string only): `lexipwn setpsval [tagname1] [tagvalue1] [tagname2] [tagvalue2] ...`

### Editing devinfo partition (GUI)

The following PS tags are available for editing via the lexipwn GUI:

* `bootmode` (device boot mode, `normal` or `factory`)
* `imei1` and `imei2`
* `psn`
* `dsn`
* `wlan_mac1` (WLAN MAC address)
* `bt_addr` (Bluetooth MAC address)
* `pcbcfg` (PCB config)
* `devcfg` (Dev config)
* `sku`
* `coo` (country of origin)
* `dpc`
* `wcc`

On start, lexipwn GUI will read the above tags into corresponding fields of the "Devinfo editor" tab. You can reload the tags at any time by pressing the "Load devinfo" button. After editing the tags, you must press the "Save devinfo" button and confirm the operation. Upon reboot, the phone will read the new tag values.

### Fixing IMEI CPSHA values after IMEI repair

If you have altered the IMEI values in devinfo and then rebooted, the device will most probably report 000000000000000 for both IMEI numbers to `*#06#` and to the network. In order to fix this, you need to first boot into the factory mode (set the `bootmode` PS tag to `factory`, save the devinfo partition and reboot the phone), then press the "Fix IMEI CPSHA" button in the lexipwn GUI or run `lexipwn fiximeisha` in the CLI. Then you can (optionally) revert back to the normal boot mode and the new IMEIs will become visible upon reboot.

**N.B.: in case cellular radio doesn't work after the CPSHA fix, it is advised to return from the factory mode back to normal first.**

**N.B.2: if CPSHA fix doesn't help the first time, issue the same command and reboot the device once again.**

### Randomizing IMEIs (CLI)

Just run `lexipwn genimei [prefix]`. The prefix can be any combination from 0 to 14 digits. Without the prefix, the IMEI will be fully random. You can use the output to substitute into another command, e.g. `lexipwn setpsval imei2 $(lexipwn genimei)` which will fully randomize IMEI2 value.

### Randomizing IMEIs (GUI)

In the "Utilities" tab, under the "IMEI/MAC generator" section, enter the prefix (if necessary) into the "IMEI prefix/TAC" field and then tap the "Randomize IMEI 1" or "Randomize IMEI 2" button. The program will substitute the corresponding field in the "Devinfo editor" tab and switch to that tab. Note that this action won't overwrite the devinfo partition, you'll need to tap the "Save devinfo" button to save the result and then perform the CPSHA fix accordingly.

### Randomizing MAC addresses (GUI only)

In the "Utilities" tab, under the "IMEI/MAC generator" section, enter the prefix (if necessary) into the "MAC prefix" field (just hex values or separated with colons) and then tap the "Randomize WLAN MAC" or "Randomize BT MAC" button. The program will substitute the corresponding field in the "Devinfo editor" tab and switch to that tab. Note that this action won't overwrite the devinfo partition, you'll need to tap the "Save devinfo" button to save the result.

### Running AT commands

You can run simple, single-line AT commands on the Pixel's modem using lexipwn. In the CLI mode, just run `lexipwn atcmd '[your_command]'` and see the result (if it's returned immediately). In the GUI, you can head to the "Utilities" tab, enter the command under the "AT command runner" section, tap the "Run AT command" button and see the result in the text field below.

## The tech behind lexipwn

Every Tensor-based Google Pixel phone that exists nowadays (from 6 up to 9 Pro Fold) uses a small, 8192-byte FS-less partition called `devinfo` to store critical device-specific information like serial numbers, IMEIs and primary MAC addresses. Unlike e.g. Qualcomm-based devices, the information in this partition is the source of truth for EFS and other places. The lexipwn project has its roots in an older research that led to creation of the [pxlycan](https://git.luxferre.top/pxlycan/file/pxlycan.tcl.html) tool, which is just an offline devinfo partition editor to use from a PC with Tcl installed. 

The devinfo partition essentially consists of three areas: information header area (first 128 bytes 0-127), PS (protocol station) tag area (from the 128th byte until the half of the file) and PSENV (protocol station environment) tag area (from the 4096th byte until the end of the file). While the pxlycan.tcl tool could edit any of those, lexipwn is only focused on editing the PS tag area, i.e. string tags that can usually be set at the factory only. Moreover, the total set of tags can vary from model to model, so the GUI version only allows you to edit the tags that can be encountered in any of them.

However, any production-grade Pixel has an IMEI integrity protection mechanism built into its (Exynos-based) modem firmware. An internal SHA256 checksum (based upon the values of both IMEI numbers and probably something else) is stored in the `persist` partition, in the `/mnt/vendor/persist/modem/cpsha` file in its ASCII form. If any of the IMEI values stored in the devinfo partition do not match this hash, the modem will report all zeroes for both IMEIs to the screen and to the network. Early Pixel models like 6 and 6 Pro allowed to bypass this check by lowering the board stage code in the devinfo header area, but this didn't work in the later generations. In order to properly fix this CPSHA file, the calculation request must be made to the modem itself, which can be done via the `AT+GOOGGETIMEISHA` command and manually copying its output to the above path. This command, however, can only work if the phone itself is booted into the factory mode, which in turn can be achieved by modifying the corresponding devinfo PS area tag called `bootmode` by setting it from `normal` to `factory` and a subsequent reboot.

The last question to clarify is how the AT commands can be run on the Pixel devices. Unfortunately, the only interface that's currently known there is by writing to and reading from the `/dev/umts_router` file, which is not even a proper serial device and cannot be interacted with by the means of `microcom` or other serial terminal software. The AT commands are written one by one to this file, then the responses are read back from it. Not all commands respond immediately though, so sometimes we just don't know when to expect the response. For the purpose of just running `AT+GOOGGETIMEISHA`, lexipwn doesn't implement any response heuristics and only returns the output that it can read immediately, which is fine with this particular AT command. For the sake of completeness, the functionality of running any single-line AT command is also implemented in the program.

Using all this knowledge, you can now freely create your own devinfo manipulation tool if you don't like lexipwn for any reason.

## Credits

Created by Luxferre in 2024-2025, released into public domain with no warranties.

Special thanks to SamsungGuy for the tips on the CPSHA fix.