Database Develop

[Security breach?] Your data is NOT SAFE! Simple bypass of data wipe when unlocking

I've always been a bit startled by how the bootloader bootloader is unlocked on my nexus 4. After pushing the unlock command to my device and choosing "yes", the bootloader is unlocked right away. The data isn't wiped before I reboot into the system, while on the nexus 7 the bootloader is not unlocked before after the wipe.
Yesterday i re-locked, rebooted and unlocked my device again as an experiment. I then proceeded to boot a custom recovery without rebooting into the system. I suceded, and was able to boot into TWRP without the bootloader wiping my data. I could then proceed to adb pull/push watever i wished from the data partition or any other partition without the data having been wiped. What? I thought my data was secure after re-locking my bootloader, but it appears it isn't.
If this applies to all nexus 4 devices, I was also able to reboot into the system after wiping cace from TWRP. This means you can oem unlock and root without without my data being wiped simply by booting a custom recovery right after unlocking.
If this applies to all nexus 4 devices, our data is not safe. This means that even normal users with locked bootloaders can have their data stolen easy as pie. We need more confirmations on this issue to confirm it. If you are willing to try, just follow the instructions below. Please report if it works or if it doesn't. WARNING! Do this at your own risk! I'm not responsible if your data is wiped, etc. Please perform a full nandroid or adb backup and copy it to a safe place before performing the following seps:
1. If you're unlocked, re-lock your bootloader and reboot into fastboot:
Code:
fastboot oem lock
fastboot reboot-bootloader
2. Unlock your bootloader:
Code:
fastboot oem unlock
3. There's no need to reboot into bootloader after performing the previous step. It makes no difference. Just do not reboot into the system.
4. Flash or boot a custom recovery:
Code:
fastboot flash recovery custom_recovery.img
OR
Code:
fastboot boot custom_recovery.img
5. Now you're in custom recovery if all goes as expected. Root by flashing SuperSU/whatever or pull data with adb or do some serious damage! :good:
6. If you want to reboot back into your system without loosing data, you'll have to wipe cache in custom recovery. This prevents the bootloader from rebooting back into the stock recovery (if you didn't overwrite it) and wipe your phone. If you flashed a custom recovery and you're stuck in a bootloop or something, this applies to you too.
And again: Please report back if it worked or if it didn't! Good luck! :^)
Edit: This wasn't all my idea. Found out about the last cache wipe step here.

fiskenigaten said:
I've always been a bit startled by how the bootloader bootloader is unlocked on my nexus 4. After pushing the unlock command to my device and choosing "yes", the bootloader is unlocked right away. The data isn't wiped before I reboot into the system, while on the nexus 7 the bootloader is not unlocked before after the wipe.
Yesterday i re-locked, rebooted and unlocked my device again as an experiment. I then proceeded to boot a custom recovery without rebooting into the system. I suceded, and was able to boot into TWRP without the bootloader wiping my data. I could then proceed to adb pull/push watever i wished from the data partition or any other partition without the data having been wiped. What? I thought my data was secure after re-locking my bootloader, but no!
I was also able to reboot into the system after wiping cace from TWRP. This means I can oem unlock and root without without my data being wiped simply by booting a custom recovery right after unlocking.
I want to find out if this applies to all other makos on all bootloaders. If you are willing to try, this is what I did. Please report if it works or if it doesn't. WARNING! Do this at your own risk! I'm not responsible if your data is wiped. Please perform a full nandroid backup and copy it to a safe place before performing the following seps:
1. If you're unlocked, re-lock your bootloader and reboot into fastboot:
Code:
fastboot oem lock
fastboot reboot-bootloader
2. Unlock your bootloader:
Code:
fastboot oem unlock
3. There's no need to reboot into bootloader after performing the previous step. It makes no difference. Just do not reboot into the system.
4. Flash or boot a custom recovery:
Code:
fastboot flash recovery custom_recovery.img
OR
Code:
fastboot boot custom_recovery.img
5. Now you're in custom recovery if all goes as expected. Root by flashing SuperSU/whatever or pull data with adb or do some serious damage! :good:
6. If you want to reboot back into your system without loosing data, you'll have to wipe cache in custom recovery. For some reason this keeps the stock recovery from wiping the phone. If you flashed a custom recovery and you're stuck in a bootloop or something, this applies to you too.
And again: Please report back if it worked or if it didn't! Good luck! :^)
Edit: This wasn't all my idea. Found out about the last cache wipe step here.
Click to expand...
Click to collapse
The upside is, the person who steals or finds your phone is most likely not a developer, an android nerd, or has ever heard of XDA to gain this information.

Semantics said:
The upside is, the person who steals or finds your phone is most likely not a developer, an android nerd, or has ever heard of XDA to gain this information.
Click to expand...
Click to collapse
/deleted I have no idea what I'm talking

Not up for experimenting, but it reminded me of my experience on the N4.
-initial BL unlock via the standard method = data wiped,
-upon relocking, and then unlocking the BL again = no data wipe (same method as above)
Can't recall if the behaviour was the same on my GN.

CMNein said:
Not up for experimenting, but it reminded me of my experience on the N4.
-initial BL unlock via the standard method = data wiped,
-upon relocking, and then unlocking the BL again = no data wipe (same method as above)
Can't recall if the behaviour was the same on my GN.
Click to expand...
Click to collapse
My data is allways wiped after bootloader unlock, but it is only wiped upon reboot. It was like that the first time as well.

I can almost (95%) confirm this, because the first time I unlock my Nexus 4, I fastboot flash cwm directly, and boot into recovery, to flash PA and wipe cache and data. Everything in my sdcard was intact and I was also confused like you did.
Maybe if I ever wanted to full wipe again I will give it a try...

ksilver89 said:
I can almost (95%) confirm this, because the first time I unlock my Nexus 4, I fastboot flash cwm directly, and boot into recovery, to flash PA and wipe cache and data. Everything in my sdcard was intact and I was also confused like you did.
Maybe if I ever wanted to full wipe again I will give it a try...
Click to expand...
Click to collapse
Excactly! This is really careless by Google. It means NO nexus 4 without encryption is safe! I want my data to be safe!

I don't get it. I thought even Samsung's phones you can do that? Just just go flash cf root then yeah done? Are they even trying to protect the data in your internal memory data from getting stolen?

fiskenigaten said:
My data is allways wiped after bootloader unlock, but it is only wiped upon reboot. It was like that the first time as well.
Click to expand...
Click to collapse
Sorry, I should have clarified I was referring to the virtual sdcard side of it.

Yup this is the exact reason I opened a thread about compatibility issues with encryption and CWM recovery. We have to encrypt our phones if we want to secure our data. What are the options once we go the 3rd party recovery route is another question.
http://forum.xda-developers.com/showthread.php?p=41257911
Sent from my Nexus 4 using Tapatalk 2

Excactly! This is really careless by Google. It means NO nexus 4 without encryption is safe! I want my data to be safe!
Click to expand...
Click to collapse
Guess it's time to encrypt your device then...
Seriously, bugs and exploits are going to happen. This is software written by humans, after all.
If you are serious about data security on your device, you would have already encrypted by now.

Can confirm easily. I relocked my boot loader with my phone at its current state. (CMRC1 + Bricked Kernel). Then proceeded to unlock, rebooted boot loader, booted into recovery, wipe cache, data intact
Sent from my Nexus 4 using xda premium

Well if someone steals your phone they most likely don't give a **** about your data (unless there's bank info on it) they probably just wanna resell it for an easy 3-400$
Sent from my Nexus 4 @1.72 GHz on Stock 4.2.2

To be honest if you want your bank info safe never put it on a device that is easily lost or stolen or transmits the info over the air.
Wayne Tech Nexus

Guys, honest question. If someone were to grab your data but you encrypted it via the settings menu, does that mean they can still decipher your contents? For example, the TSA is known to get your electronic items and copy the data for their "Security protocol." Would this allow them to copy the data but not decipher it?
Sent from my Nexus 4

nexicon said:
Guys, honest question. If someone were to grab your data but you encrypted it via the settings menu, does that mean they can still decipher your contents? For example, the TSA is known to get your electronic items and copy the data for their "Security protocol." Would this allow them to copy the data but not decipher it?
Sent from my Nexus 4
Click to expand...
Click to collapse
If the TSA got ahold of your device they would be able to decrypt it easily enough. No amount of encryption would prevent that.

zelendel said:
If the TSA got ahold of your device they would be able to decrypt it easily enough. No amount of encryption would prevent that.
Click to expand...
Click to collapse
Nothing in this country is safe and private anymore. Sigh..
Sent from my Nexus 4

nexicon said:
Nothing in this country is safe and private anymore. Sigh..
Sent from my Nexus 4
Click to expand...
Click to collapse
Not really. The only way to beat Gov hackers is to be a better hacker.

zelendel said:
Not really. The only way to beat Gov hackers is to be a better hacker.
Click to expand...
Click to collapse
Easy for you to say
Sent from my Nexus 4

nexicon said:
Easy for you to say
Sent from my Nexus 4
Click to expand...
Click to collapse
No not really man. Not sure what Country your in but it is most likely not very different here.

TWRP Wipe for a used device

I recently bought a used Nexus 6 in mint condition, but I noticed after a factory reset in TWRP that I still see old install folders and even some of the previous owner pics and docs.
How do I do a proper wipe without missing something up like the rom itself? What settings in TWRP should I use without killing the rom.
Thanks in advance

rsalas187 said:
I recently bought a used Nexus 6 in mint condition, but I noticed after a factory reset in TWRP that I still see old install folders and even some of the previous owner pics and docs.
How do I do a proper wipe without missing something up like the rom itself? What settings in TWRP should I use without killing the rom.
Thanks in advance
Click to expand...
Click to collapse
Do a data factory reset in /settings/backup and restore/factory reset/. Backup first off course, this will wipe the device.

gee2012 said:
Do a data factory reset in /settings/backup and restore/factory reset/. Backup first off course, this will wipe the device.
Click to expand...
Click to collapse
So don't even use the TWRP factory reset?

Format Data

Factory reset in twrp doesn't wipe sdcard. Also factory reset in settings uses recovery default which if twrp also, doesn't wipe sdcard.
In twrp go to wipe > advanced wipe > internal storage

rsalas187 said:
So don't even use the TWRP factory reset?
Click to expand...
Click to collapse
If you prefer that you can:
Wipe cache and dalvik cache, data factory reset and reboot. Also backup apps and files/pics etc first. Do not wipe system or sdcard!

gee2012 said:
If you prefer that you can:
Wipe cache and dalvik cache, data factory reset and reboot. Also backup apps and files/pics etc first. Do not wipe system or sdcard!
Click to expand...
Click to collapse
He wants to wipe sdcard...

rootSU said:
He wants to wipe sdcard...
Click to expand...
Click to collapse
Don't think so if I read the op right, at least don't hope so ?
Verstuurd vanaf mijn Nexus 6 met Tapatalk

gee2012 said:
Don't think so if I read the op right, at least don't hope so ?
Verstuurd vanaf mijn Nexus 6 met Tapatalk
Click to expand...
Click to collapse
Yeah he does. He wants to wipe all the pictures from previous owner on sdcard but can't because twrp doesn't do that unless he follows my instructions s

rootSU said:
Yeah he does. He wants to wipe all the pictures from previous owner on sdcard but can't because twrp doesn't do that unless he follows my instructions s
Click to expand...
Click to collapse
Oké, doesn't do data factory reset in settings do the same? Wipe user data.
Verstuurd vanaf mijn Nexus 6 met Tapatalk

gee2012 said:
Oké, doesn't do data factory reset in settings do the same? Wipe user data.
Verstuurd vanaf mijn Nexus 6 met Tapatalk
Click to expand...
Click to collapse
Twrp does not wipe sdcard. This is done on purpose to save sdcard for ROM flashers. It is no good wiping a device before flashing a ROM if the ROM you want to flash is wiped from sdcard.
Only stock ROM wipes sdcard with factory reset
Reset from settings uses recovery. So of stock recovery installed, using setting wipes sdcard. If twrp installed, using settings does not wipe sdcard.

rootSU said:
Twrp does not wipe sdcard. This is done on purpose to save sdcard for ROM flashers. It is no good wiping a device before flashing a ROM if the ROM you want to flash is wiped from sdcard.
Only stock ROM wipes sdcard with factory reset
Reset from settings uses recovery. So of stock recovery installed, using setting wipes sdcard. If twrp installed, using settings does not wipe sdcard.
Click to expand...
Click to collapse
Oké got it bro.
Verstuurd vanaf mijn Nexus 6 met Tapatalk

you can always wipe the sd storage with twrp, but you have to specificly choose your storage to be wiped.

Failure of Factory Reset
I bought a Nexus 6 today, and listen to the "father" tell me that his "son" placed TWRP for recovery and installed PureNexus ROM on the device. Of course, I figured that this wasn't and issue, and the first thing that I did was do a factory reset. I issued the reset and once I was in TWRP, I immediately received a fail. I did a fastboot to a newer version of TWRP, but still no joy.
I have tried advance wipe and still nothing. Is there any pointers on where I might find the answer to being able to do a factory reset.

kcallis said:
I bought a Nexus 6 today, and listen to the "father" tell me that his "son" placed TWRP for recovery and installed PureNexus ROM on the device. Of course, I figured that this wasn't and issue, and the first thing that I did was do a factory reset. I issued the reset and once I was in TWRP, I immediately received a fail. I did a fastboot to a newer version of TWRP, but still no joy.
I have tried advance wipe and still nothing. Is there any pointers on where I might find the answer to being able to do a factory reset.
Click to expand...
Click to collapse
Need some details here... First and foremost, what kind of fail are you talking about? Is there an error message?
(It's also interesting to know what kind of factory reset you did. The "normal" way in settings or in TWRP?)

Didgeridoohan said:
Need some details here... First and foremost, what kind of fail are you talking about? Is there an error message?
(It's also interesting to know what kind of factory reset you did. The "normal" way in settings or in TWRP?)
Click to expand...
Click to collapse
The first time I did a Factory Reset was via the Setting --> Backup & reset --> Factory data reset. At which time, TWRP kicked in and attempted the automatic Factory reset.
Code:
Updating partition details..
... done
Full SELinux support is present.
Simulating actions...
At the top was the following:
Code:
OpenRecoveryScript Complete
Failed
So I thought there might be an issue with the version I was running so I followed up with going into the bootloader and then:
Code:
fastboot flash recovery openrecovery-twrp-2.8.5.0-shamu.img
I even tried to fastboot oem unlock:
Code:
[email protected]:~/Downloads/Nexus 6$ fastboot oem unlock
...
(bootloader) Device state transition will erase userdata.
(bootloader) Are you sure you want to continue this transition?
(bootloader)
(bootloader) Press POWER key to continue.
(bootloader) Press VOL UP or VOL DOWN key to cancel state transition.
(bootloader) State transition confirmed!
(bootloader) Please select 'YES' on screen if you want to continue...
(bootloader) Unlocking bootloader...
(bootloader) Not supported command in current status!
FAILED (remote failure)
finished. total time: 38.915s
I booted back into recovery and then tried to do a wipe. That one failed! I tried other partitions and still failed. So while the ROM seems to be working fine, I have not been able to do the factory reset and as such have not been able to first time boot where I could start the 1st time start so I could get the google cloud stuff downloaded to the device. I guess I could just go into Play and download stuff, but I would like to truly make this into my own device.

Sounds like the bootloader is locked. Go to settings in the ROM and tap on the build number seven times to expose Developer Options. Go to Developer Options and make sure "Enable OEM Unlock" is checked. Then try unlocking the bootloaded.
If you're successful, you can then replace TWRP with an updated version and go from there to customize the Nexus. This includes using TWRP to wipe the Nexus.

Didgeridoohan said:
Need some details here... First and foremost, what kind of fail are you talking about? Is there an error message?
(It's also interesting to know what kind of factory reset you did. The "normal" way in settings or in TWRP?)
Click to expand...
Click to collapse
Strephon Alkhalikoi said:
Sounds like the bootloader is locked. Go to settings in the ROM and tap on the build number seven times to expose Developer Options. Go to Developer Options and make sure "Enable OEM Unlock" is checked. Then try unlocking the bootloaded.
If you're successful, you can then replace TWRP with an updated version and go from there to customize the Nexus. This includes using TWRP to wipe the Nexus.
Click to expand...
Click to collapse
It is already in Developer Mode and the OEM is unlocked. One of the first things that I checked...

kcallis said:
It is already in Developer Mode and the OEM is unlocked. One of the first things that I checked...
Click to expand...
Click to collapse
Try instead to flash a factory image. Might work and your device will be nice and clean.
And TWRP 2.8.5.0 is ancient (sort of). Latest is 3.0.2-0.

Didgeridoohan said:
Try instead to flash a factory image. Might work and your device will be nice and clean.
And TWRP 2.8.5.0 is ancient (sort of). Latest is 3.0.2-0.
Click to expand...
Click to collapse
That was the trick... 3.0.2 made the factory reset a breeze

All Content Wiped

Ive been using a custom rom for some time all working fine, today I thought Id try another so I booted to recovery, full wiped and flashed another rom & gapps package.
It seemed to install and TWRP promted to reboot system which I did.
Now the problem begins, it only booted to the black google screen. I hard reset to get into recovery and everything had gone including internal storage.
I was able to push my rom and gapps zips to data but when I try to install TWRP throws up errors about unable to mount storage data etc...
I tried flashing latest TWRP and erasing cache, but still same problem.
So I have no idea how to turn this paperweight back into a phone!

Try
fastboot format cache
fastboot format userdata

rootSU said:
Try
fastboot format cache
fastboot format userdata
Click to expand...
Click to collapse
Thank you very much rootSU
I was trying to find the adb help guide you posted before, thought I had it bookmarked but I didn't and now I remember the name rootSU.
You helped me out once before when I had problems with my DHD.
Thanks again, very much appreciated.

djcsurf said:
Thank you very much rootSU
I was trying to find the adb help guide you posted before, thought I had it bookmarked but I didn't and now I remember the name rootSU.
You helped me out once before when I had problems with my DHD.
Thanks again, very much appreciated.
Click to expand...
Click to collapse
No.probs

rootSU said:
No.probs
Click to expand...
Click to collapse
Score another victory for "Ace"!

[Q] Bricked Nexus 6 PLEASE HELP!!

Trying to sell my Nexus 6 I believe I bricked it. After rooting the device I used Chainfire 3d program and it made me stuck on google sign. I tried literally everything. I can boot into teamwin TWR recovery. I tried factory resetting wiping cache and delvic. Problem is my bootloader is coming up locked. Tried using fastboot many times to flash everything back keep getting remote failure. Need help, is it possible im just screwed at this point. Ive used about everything it is just stuck saying Google. PLEASE HELP!!!!

chainfires 3d program hasnt worked on a nexus in years. and you do need to boot back up to enable unlocking the bootloader in the developer options. have you tried wiping data in twrp recovery?

zacrivera24 said:
Trying to sell my Nexus 6 I believe I bricked it. After rooting the device I used Chainfire 3d program and it made me stuck on google sign. I tried literally everything. I can boot into teamwin TWR recovery. I tried factory resetting wiping cache and delvic. Problem is my bootloader is coming up locked. Tried using fastboot many times to flash everything back keep getting remote failure. Need help, is it possible im just screwed at this point. Ive used about everything it is just stuck saying Google. PLEASE HELP!!!!
Click to expand...
Click to collapse
Relax, deep breath. You need to use fastboot from bootloader. Issue these commands:
fastboot format cache
fastboot format userdata
That should get you into TWRP and from there you can transfer a ROM to internal, flash it and go from there.

Evolution_Freak said:
Relax, deep breath. You need to use fastboot from bootloader. Issue these commands:
fastboot format cache
fastboot format userdata
That should get you into TWRP and from there you can transfer a ROM to internal, flash it and go from there.
Click to expand...
Click to collapse
well, he wrote that he can boot into twrp recovery already. wiping data should fix his use of chainfires app. but flashing a new rom would do the same

simms22 said:
well, he wrote that he can boot into twrp recovery already. wiping data should fix his use of chainfires app. but flashing a new rom would do the same
Click to expand...
Click to collapse
Yeah, guess I missed that part.

Evolution_Freak said:
Yeah, guess I missed that part.
Click to expand...
Click to collapse
thinking about it now.. with the bootloader locked, would twrp let you flash anything?

simms22 said:
thinking about it now.. with the bootloader locked, would twrp let you flash anything?
Click to expand...
Click to collapse
Yes, it has been done to fix the soft brick I thought we were dealing with here. Only if TWRP is installed though.

Doesn't chainfire 3d modify system? I though it did. May need to flash a rom zip after a factory reset.

rootSU said:
Doesn't chainfire 3d modify system? I though it did. May need to flash a rom zip after a factory reset.
Click to expand...
Click to collapse
honestly, i dont remember. its been about 3-4 years since last thinking of that app. if it does, a rom flash would be needed.

[Solved / Fixed ]Cannot decrypt the phone after flashing the flyme build

Hi ,
I am not a noob, but yesterday out of curiosity flashed the flyme build in the unified section. However, after the TWRP reboot to system, it did not boot. So tried to reboot the recovery and success. But the villian was there, encryption password. I tried giving my phone PIN, it said wrong password.
After half an hour, i installed the stock image(3.5.1) using the msm tool. Well it booted fine and phone is usable. Unlocked the bootloader and flashed the latest TWRP,.
The villian is back, asking for password. Now it is taking any password, always say wrong password. Ok in case i skip the decrypt screen, i cannot access the sdcard to flash new rom.
Is this the end of story of my op3t?

Have you tried "default_password"?

Didgeridoohan said:
Have you tried "default_password"?
Click to expand...
Click to collapse
Tried everything. The phone boots into OOS 3.5.1 after msm tool flash without password. Even it behaves very well. Only after the TWRP installation. It is stuck for password. I think its end of story.

Prashanthme said:
Tried everything. The phone boots into OOS 3.5.1 after msm tool flash without password. Even it behaves very well. Only after the TWRP installation. It is stuck for password. I think its end of story.
Click to expand...
Click to collapse
Then I don't know... Usually if TWRP suddenly starts asking for a password without having set one, using "default_password" will work.
You could try flashing a kernel that disables forced encryption and then format data to unencrypt.

You have to make sure to restore system to the version using the same encryption libraries as used the last time you could decrypt the data partition. If all fails you will have to format your data partition and loose it all.

pitrus- said:
You have to make sure to restore system to the version using the same encryption libraries as used the last time you could decrypt the data partition. If all fails you will have to format your data partition and loose it all.
Click to expand...
Click to collapse
I have already lost the data. TWRP not allowing me to enter the sdcard storage to flash anything. Can u brief me how to format the data partition.

Just bootup phone into fastboot mode from the unlocked bootloader menu, then connect to PC and run "fastboot format userdata" from a path with either fastboot in or anywhere of you've added the folder with fastboot in you PATH variable.

pitrus- said:
Just bootup phone into fastboot mode from the unlocked bootloader menu, then connect to PC and run "fastboot format userdata" from a path with either fastboot in or anywhere of you've added the folder with fastboot in you PATH variable.
Click to expand...
Click to collapse
Did this. But after should i flash the stock image again? Because system is not booting and stuck in oneplus logo.
How about fastboot erase options?

I disabled encryption one year ago to avoid this problem, and therefore have never experienced it. But why don't you do a compete MSM restore? That should restore even the data partition.

pitrus- said:
I disabled encryption one year ago to avoid this problem, and therefore have never experienced it. But why don't you do a compete MSM restore? That should restore even the data partition.
Click to expand...
Click to collapse
Let me try once i go home and update u. Thanks for the response..
Will format the data from fastboot. and flash the stock image. Hope this works.

Finally happened to work.
Installed a different version twrp made the trick. But this time i erased the recovery and flashed again. After that wiped all the data and then sideloaded the rom from adb and it did the trick..

pitrus- said:
I disabled encryption one year ago to avoid this problem, and therefore have never experienced it. But why don't you do a compete MSM restore? That should restore even the data partition.
Click to expand...
Click to collapse
Can you please tell me how you disabled encryption?

Vidicgapi said:
Can you please tell me how you disabled encryption?
Click to expand...
Click to collapse
You do this by flashing the latest no-verity-opt-encrypt zip file after formatting the data partition and also after each update of the OS.
https://build.nethunter.com/android-tools/no-verity-opt-encrypt/no-verity-opt-encrypt-5.1.zip