Hacker News Reader

Comment by milankragujevic | Hacker News Reader

Unfortunately, a majority of new Unisoc (Spreadtrum) chips have bootloaders that cannot be unlocked without a key, which is not provided by the SOC manufacturer, and is beyond the control of the ODM. Many low-end Android smartphones are powered by such chips, and the end result is that root is impossible on those devices, i.e. ZTE Blade A5 2019, Doogee N10, etc. (Unisoc SC9863A)

edit: I have obtained the source code of the U-boot bootloader used on those devices, however, the algorithm for the key verification is stored on the Trusted Execution Environment, which means it cannot be extracted (the TEE is a SecureEnclave-like device, with no possible direct access to it's memory or storage, besides de-capping it and reading the bits with an electron microscope) -- more info here: https://source.android.com/security/trusty

View on HN

I wasn't aware of this, for some reason I thought most of the low-ends are mediatek, and unlocking android 6 mediateks was not a hard feat.

EDIT I don't think Doogee N10 falls into low end, at least not by specs. Compare it with Moto C, which is indeed low end.

Oh, Mediatek is so-"friendly" to unlocking, with no verified boot and the ability to flash it with the infamous SP Flash Tool.

SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc.

It genuinely does cryptographicaly verify the signature and hash of every partition. Which is great for security, in theory, unless the OS has preloaded spyware, but the secureboot process prevents you from removing it.

re-edit: Doogee N10 costs 85$. I don't think you can go much lower-end, without basically giving the manufacturer a huge profit margin (i.e. a phone that costs $60, but has 512 MB RAM, has a bigger profit margin than a phone that costs 85$ but has 3 GB RAM.)

> SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc.

Been there, and I didn't even realised the cause. I'm sorry if my previous comment seemed light hearted, I didn't want it to be so.

I understand fully. I just want to shine light on the problems of consumers loosing control of their devices that they own and paid for. I would understand that a work-provided device has such protections, and spyware, because it's provided for a single purpose, usually under contract.

A device that you buy with your own money cannot "hand-wave" the contract (TOS, EULA, Policies, etc), and say it's OK that you don't own your device or your data.

I chose MTK because of it being open-by-default and all the leaked datasheets/programming guides/source code available. You can really run whatever you want on those devices, with enough effort.

It's somewhat surprising that the other low-end SoCs are locked by default... I wonder if the key is the same for all of them, and just hasn't been leaked yet.

MTK is quite good, but it's becoming worse in the perf/$ ratio, i.e. the SC9863A is a octa core A55 chip at 1.5GHz, while similar MTK devices are dual core A7 at 1.2 GHz. The architecture improvements alone are excellent, not mentioning the extra cores and higher clock speed.

The key is most certainly not the same, because I doubt they would go through the trouble of doing actual secure boot verification, and storing the data in the TEE, and just have the same key. Additionally, the U-boot code I obtained lies to the user about commands not being found, if the command doesn't contain a valid unlock key.

Reply on news.ycombinator.com