【贴图】锤子手机Bootloader遭破解
摘要：罗永浩曾经承诺开放锤子手机的Bootloader，却没有实现，最终遭到了用户的起诉。虽然最后还是不了了之，但是从技术角度讲，解锁锤子手机的Bootloader也并非绝无可能。国内越狱团队盘古(@PanguTeam)经过一番研究后，就已经破解了锤子T1、T2的Bootloader。盘古团队已经公布了详细的分析、解锁过程，简单来说就是利用了锤子手机的漏洞解锁Bootloader，因为锤子T1、T2和绝大多数高通平台手机一样，也使用了高通开源的lk。http://cms-bucket.nosdn.127.net/catchpic/6/6c/6cade9036eaf0e19895f07fd0b5e2749.jpg?imageView&thumbnail=550x0配图最后刷入security.img之后，锤子T2被成功解锁，而锤子T1 Bootloader其实也是差不多的，同理也能解锁。另外，Smartisan OS 2.6.8开始代码变化较大，解锁需要先降级到2.6.7版本再执行。http://cms-bucket.nosdn.127.net/catchpic/b/b4/b4c803f443eafc19ebfb7acd97c0a4f7.jpg?imageView&thumbnail=550x0图1.注册fastboot commandhttp://cms-bucket.nosdn.127.net/catchpic/d/db/dbb9d1380430dd18b2eae52d298ddaaf.jpg?imageView&thumbnail=550x0图2.fastboot可以注册的命令列表http://cms-bucket.nosdn.127.net/catchpic/2/20/2070a12735fd5bcf2f3c97b4e1c3f292.jpg?imageView&thumbnail=550x0图3.写分区时的判断http://cms-bucket.nosdn.127.net/catchpic/c/c9/c980e97e591ea5267ea85d9fa603548e.jpg?imageView&thumbnail=550x0图4.对security分区的检测，判断是否可以解锁http://cms-bucket.nosdn.127.net/catchpic/f/fb/fb110be3967c0f42588e23eae9635f7b.jpg?imageView&thumbnail=550x0图5.根据security指定的函数来初始化RSA密钥http://cms-bucket.nosdn.127.net/catchpic/a/a4/a4e15236ee1d5fb11b9479ac8b253ca8.jpg?imageView&thumbnail=550x0图6.RSA密钥初始化http://cms-bucket.nosdn.127.net/catchpic/c/c0/c0a92b2b2996b75b438057fa075ea538.jpg?imageView&thumbnail=550x0图7. 读取factory分区，得到序列号，然后计算MD5http://cms-bucket.nosdn.127.net/catchpic/6/64/6453e6df85ad52e3d4b8e906b496eab5.jpg?imageView&thumbnail=550x0图8. T1刷入security.img后解锁http://cms-bucket.nosdn.127.net/catchpic/9/9d/9d1ea38475defaa7f9ccc585f7b66193.jpg?imageView&thumbnail=550x0图9.T2刷入security.img后解锁http://cms-bucket.nosdn.127.net/catchpic/8/86/864ac18dfc5ac68e7f74ccf86d005316.jpg?imageView&thumbnail=550x0http://cms-bucket.nosdn.127.net/catchpic/e/ea/eadd3992072e7cad4434d6287d8f5fdb.jpg?imageView&thumbnail=550x0
图10. 2.6.8后的版本中fastboot已经没有什么实质功能了
不懂帮顶 算是好消息
都是为了利益 好消息？ 这手机有人买？买它个锤子
买个锤子
页:
[1]