The lexipwn (pronounced as lexi-pone, derived from "pixel" backwards and "pwn") project is a fully free, open-source and universal tool to manipulate device-specific information for Tensor-based Google Pixel smartphones. It comes in two variants: a standalone CLI binary (lexipwn) developed in the lexipwn-cli subproject and a GUI APK package (lexipwn.apk) developed in the lexipwn-gui subproject, which has a hard dependency on lexipwn-cli (hence shipped in the same repo) and embeds the CLI binary for its own operation.

Both the CLI and GUI variants are written in Go 1.23.

Root access is required to run the tool in either variant!

As of now, lexipwn should work on the following Google Pixel models (provided they are rooted): 6, 6 Pro, 6a, 7, 7 Pro, 7a, Fold, 8, 8 Pro, 9, 9 Pro, 9 Pro XL, 9 Pro Fold.

Features

Edit main PS tags in the devinfo partition
Switch the boot mode (normal or factory)
Fix IMEI CPSHA after editing devinfo (requires the phone to be booted in the factory mode)
Randomize IMEIs and MACs based on TACs or other prefixes
Run arbitrary single-line AT commands
Fully offline operation, no internet necessary

Building

The prebuilt binaries of lexipwn in both variants are available in the "Releases" section of the repo and you can download and use them right away. However, this is a tool designed to run under root privileges, and, for security reasons, it is highly recommended to build your own binaries from the source code whenever possible.

Important note: https://codeberg.org/luxferre/lexipwn.git is the only original repo of lexipwn, there are no GitHub/GitLab/SourceHut/etc mirrors or other usernames or URLs unless explicitly stated otherwise in this readme and confirmed on the Luxferre's web page! If building from a fork, always verify the source code change commits against the original repo to avoid any malware!

CLI variant

To build the CLI variant of lexipwn, you need to just have Make and Go 1.23 (or above) installed. Run make cli from the repository root and you'll see the static ARM64 binary in the out/lexipwn file.

You can then push the binary to e.g. /data/local/tmp directory on the device and directly use it from the su shell in ADB or Termux.

You can also try and build the CLI variant of lexipwn on Termux itself.

GUI variant

To build the GUI variant of lexipwn, you need to have Make, Go 1.23 (or above), Android NDK and fyne command installed. You can install the Fyne toolkit using the following commands:

go get fyne.io/fyne/v2@latest
go install fyne.io/fyne/v2/cmd/fyne@latest

Additionally, you need to ensure that the ANDROID_NDK_HOME environment variable is pointing to the directory you have extracted the Android NDK to.

Then, just run make from the repository root and you'll see the Android APK package in the out/lexipwn.apk file that you can install on your rooted phone. The very first build may take a rather long time because Fyne will download all missing framework dependencies. Note that this process will also build the CLI binary, you don't need to do anything with it if you only need the GUI (the binary is embedded into the APK too).

Afterwards, you can connect your phone via ADB and install the package manually or just run make install which will do the same thing.

Usage

Editing devinfo partition (CLI)

List available PS tags (output as [type] TAB [tagname] TAB [tagvalue]): lexipwn listps
Change a PS tag type (only DIUS and DIFR are valid): lexipwn setpstype [tagname] [DIUS|DIFR]
Change PS tag values (string only): lexipwn setpsval [tagname1] [tagvalue1] [tagname2] [tagvalue2] ...

Editing devinfo partition (GUI)

The following PS tags are available for editing via the lexipwn GUI:

bootmode (device boot mode, normal or factory)
imei1 and imei2
psn
dsn
wlan_mac1 (WLAN MAC address)
bt_addr (Bluetooth MAC address)
pcbcfg (PCB config)
devcfg (Dev config)
sku
coo (country of origin)
dpc
wcc

On start, lexipwn GUI will read the above tags into corresponding fields of the "Devinfo editor" tab. You can reload the tags at any time by pressing the "Load devinfo" button. After editing the tags, you must press the "Save devinfo" button and confirm the operation. Upon reboot, the phone will read the new tag values.

Fixing IMEI CPSHA values after IMEI repair

If you have altered the IMEI values in devinfo and then rebooted, the device will most probably report 000000000000000 for both IMEI numbers to *#06# and to the network. In order to fix this, you need to first boot into the factory mode (set the bootmode PS tag to factory, save the devinfo partition and reboot the phone), then press the "Fix IMEI CPSHA" button in the lexipwn GUI or run lexipwn fiximeisha in the CLI. Then you can (optionally) revert back to the normal boot mode and the new IMEIs will become visible upon reboot.

Randomizing IMEIs (CLI)

Just run lexipwn genimei [prefix]. The prefix can be any combination from 0 to 14 digits. Without the prefix, the IMEI will be fully random. You can use the output to substitute into another command, e.g. lexipwn setpsval imei2 $(lexipwn genimei) which will fully randomize IMEI2 value.

Randomizing IMEIs (GUI)

In the "Utilities" tab, under the "IMEI/MAC generator" section, enter the prefix (if necessary) into the "IMEI prefix/TAC" field and then tap the "Randomize IMEI 1" or "Randomize IMEI 2" button. The program will substitute the corresponding field in the "Devinfo editor" tab and switch to that tab. Note that this action won't overwrite the devinfo partition, you'll need to tap the "Save devinfo" button to save the result and then perform the CPSHA fix accordingly.

Randomizing MAC addresses (GUI only)

In the "Utilities" tab, under the "IMEI/MAC generator" section, enter the prefix (if necessary) into the "MAC prefix" field (just hex values or separated with colons) and then tap the "Randomize WLAN MAC" or "Randomize BT MAC" button. The program will substitute the corresponding field in the "Devinfo editor" tab and switch to that tab. Note that this action won't overwrite the devinfo partition, you'll need to tap the "Save devinfo" button to save the result.

Running AT commands

You can run simple, single-line AT commands on the Pixel's modem using lexipwn. In the CLI mode, just run lexipwn atcmd '[your_command]' and see the result (if it's returned immediately). In the GUI, you can head to the "Utilities" tab, enter the command under the "AT command runner" section, tap the "Run AT command" button and see the result in the text field below.

The tech behind lexipwn

Every Tensor-based Google Pixel phone that exists nowadays (from 6 up to 9 Pro Fold) uses a small, 8192-byte FS-less partition called devinfo to store critical device-specific information like serial numbers, IMEIs and primary MAC addresses. Unlike e.g. Qualcomm-based devices, the information in this partition is the source of truth for EFS and other places. The lexipwn project has its roots in an older research that led to creation of the pxlycan tool, which is just an offline devinfo partition editor to use from a PC with Tcl installed.

The devinfo partition essentially consists of three areas: information header area (first 128 bytes 0-127), PS (protocol station) tag area (from the 128th byte until the half of the file) and PSENV (protocol station environment) tag area (from the 4096th byte until the end of the file). While the pxlycan.tcl tool could edit any of those, lexipwn is only focused on editing the PS tag area, i.e. string tags that can usually be set at the factory only. Moreover, the total set of tags can vary from model to model, so the GUI version only allows you to edit the tags that can be encountered in any of them.

However, any production-grade Pixel has an IMEI integrity protection mechanism built into its (Exynos-based) modem firmware. An internal SHA256 checksum (based upon the values of both IMEI numbers and probably something else) is stored in the persist partition, in the /mnt/vendor/persist/modem/cpsha file in its ASCII form. If any of the IMEI values stored in the devinfo partition do not match this hash, the modem will report all zeroes for both IMEIs to the screen and to the network. Early Pixel models like 6 and 6 Pro allowed to bypass this check by lowering the board stage code in the devinfo header area, but this didn't work in the later generations. In order to properly fix this CPSHA file, the calculation request must be made to the modem itself, which can be done via the AT+GOOGGETIMEISHA command and manually copying its output to the above path. This command, however, can only work if the phone itself is booted into the factory mode, which in turn can be achieved by modifying the corresponding devinfo PS area tag called bootmode by setting it from normal to factory and a subsequent reboot.

The last question to clarify is how the AT commands can be run on the Pixel devices. Unfortunately, the only interface that's currently known there is by writing to and reading from the /dev/umts_router file, which is not even a proper serial device and cannot be interacted with by the means of microcom or other serial terminal software. The AT commands are written one by one to this file, then the responses are read back from it. Not all commands respond immediately though, so sometimes we just don't know when to expect the respnonse. For the purpose of just running AT+GOOGGETIMEISHA, lexipwn doesn't implement any response heuristics and only returns the output that it can read immediately, which is fine with this particular AT command. For the sake of completeness, the functionality of running any single-line AT command is also implemented in the program.

Using all this knowledge, you can now freely create your own devinfo manipulation tool if you don't like lexipwn for any reason.

Credits

Created by Luxferre in 2024-2025, released into public domain with no warranties.