Flyme系统解锁后强制进入丢失模式

只是个笔记，没写全但是按上面的来就行了

01-01 08:07:32.372   842  4385 E NxpHal  : write error status = 0x1ff
01-01 08:07:32.372   842   842 E NxpHal  : write_unlocked failed - PN54X Maybe in Standby Mode - Retry
01-01 08:07:32.375  3771  5279 D IPowerModeImp: getCurrentModeLocked:0
01-01 08:07:32.375  3771  5279 D IPowerModeImp: stateMode = 29 getcurrentMode = 0
01-01 08:07:32.375  3771  5279 E CpuExceptionManager: receive intent: android.intent.action.SCREEN_ON
01-01 08:07:32.375  3771  5279 D PowerModeManager: receive intent: android.intent.action.SCREEN_ON
01-01 08:07:32.378   581   581 I hwservicemanager: getTransport: Cannot find entry vendor.qti.hardware.servicetracker@1.0::IServicetracker/default in either framework or device manifest.
01-01 08:07:32.380  1479  3008 D DeviceStateService: mIsFlymeVerifyEnable != null, mIsFlymeVerifyEnable: false, log:     111 ro.soc.vendor is qcom, continue.    222 proc/mz_info/sec is Secure Chip, continue.    3333 proc/mz_info/bl_unlock is 1, disable verify.
01-01 08:07:32.380  1479  3008 D DeviceStateService: doCheckState handle=3
01-01 08:07:32.380  1479  3008 D DeviceStateService: doCheckLockStateRpmb: the device is not legal!
01-01 08:07:32.380  1479  3629 D DeviceStateService: mIsFlymeVerifyEnable != null, mIsFlymeVerifyEnable: false, log:     111 ro.soc.vendor is qcom, continue.    222 proc/mz_info/sec is Secure Chip, continue.    3333 proc/mz_info/bl_unlock is 1, disable verify.
01-01 08:07:32.380  1479  3629 D DeviceStateService: doCheckState handle=4
01-01 08:07:32.380  1479  3629 D DeviceStateService: doCheckLockStateRpmb: the device is not legal!
01-01 08:07:32.381  2365  2365 V SystemModeUtils: FindPhone is lossMode
01-01 08:07:32.381  2365  2365 D SystemModeUtils: exitGuestMode lossMode() == true
01-01 08:07:32.381  1479  3008 D DeviceStateService: mIsFlymeVerifyEnable != null, mIsFlymeVerifyEnable: false, log:     111 ro.soc.vendor is qcom, continue.    222 proc/mz_info/sec is Secure Chip, continue.    3333 proc/mz_info/bl_unlock is 1, disable verify.
01-01 08:07:32.381  1479  3008 D DeviceStateService: doCheckState handle=3
01-01 08:07:32.381  1479  3008 D DeviceStateService: doCheckLockStateRpmb: the device is not legal!
01-01 08:07:32.381  1479 11920 D DeviceStateService: mIsFlymeVerifyEnable != null, mIsFlymeVerifyEnable: false, log:     111 ro.soc.vendor is qcom, continue.    222 proc/mz_info/sec is Secure Chip, continue.    3333 proc/mz_info/bl_unlock is 1, disable verify.
01-01 08:07:32.381  1479 11920 D DeviceStateService: doCheckState handle=4
01-01 08:07:32.381  1479 11920 D DeviceStateService: doCheckLockStateRpmb: the device is not legal!
01-01 08:07:32.381  2365  2365 V SystemModeUtils: FindPhone is lossMode
01-01 08:07:32.381  2815  2815 D QSLMJ   : SLM received action android.intent.action.SCREEN_ON
01-01 08:07:32.382  4070  4070 D SYS_EVENT: send event 16 notification to client
01-01 08:07:32.382   842  4383 D NxpTml  : PN54X - Write requested.....
01-01 08:07:32.382   842  4383 D NxpTml  : PN54X - Invoking I2C Write.....
01-01 08:07:32.384   842  4383 D NxpNciX : len =   7 > 20020401020100

以上为解锁bootloader后第一次开机抓取的关键log信息
其中明确写明了进入丢失模式（FindPhone is lossMode）
设备状态监测失败（doCheckLockStateRpmb: the device is not legal!）

0-----0

通过（FindPhone is lossMode）作为关键字查找整个system app 和framework
发现关键方法
[info]service.jar中的相关方法[/info]

    
// 老版本系统上定义的丢失模式方法
    public boolean lossMode() {
        DeviceStateManager v0 = this.mDeviceStateManager;
        if(v0 != null) {
            int v0_1 = v0.doCheckState(DeviceStateManager$RemoteHandle.Lock.ordinal());
            int v2 = this.mDeviceStateManager.doCheckState(DeviceStateManager$RemoteHandle.Lock_Report_Loss.ordinal());
            if(v0_1 != 1 && v2 != 1) {
                return 0;
            }

            Log.v("SystemModeUtils", "FindPhone is lossMode");
            return 1;
        }

        return 0;
    }

// 新版本系统 17p 8.1.2.2上找到的定义方法
com.android.server.policy.MzGlobalActions
   private boolean lossMode() {
        if(this.mDeviceStateManager != null && this.mDeviceStateManager.doCheckState(DeviceStateManager.RemoteHandle.Lock_Report_Loss.ordinal()) == 1) {
            Log.v("FindPhone", "lossMode");
            return 1;
        }

        return 0;
    }

// 这个是通用的外部整合接口 查询是否root 是否解锁什么的
package com.android.server.DeviceStateService ; 
 public int doCheckState(int arg5) {
        String v1 = "DeviceStateService";
        if((this.isFlymeVerifyEnable()) && !this.doFlymeVerify(arg5)) {
            Slog.d(v1, "doFlymeVerify failed, handle = " + arg5);
            return 1;
        }

        Slog.d(v1, "doCheckState handle=" + arg5);
        // 真个nactive方法很重要
        return this.nativeDoCheckState(arg5);
    }

//nativeDoCheckState的伪代码
__int64 __fastcall android::nativeDoCheckState(__int64 a1, int a2, unsigned int a3)
{
  if ( a3 - 3 < 3 ) return android::doCheckLockStateRpmb((android *)a3, a2); if ( a3 - 1 > 1 )
  return 0LL;
  return android::doCheckRootStateRpmb((android *)a3, a2);
}

__int64 __fastcall android::doCheckRootStateRpmb(android *this)
{
  unsigned __int64 v1; // x20
  int v2; // w19
  int v3; // w0
  unsigned int v4; // w19
  __int64 result; // x0
  __int128 v6; // [xsp+0h] [xbp-80h]
  __int128 v7; // [xsp+10h] [xbp-70h]
  __int128 v8; // [xsp+20h] [xbp-60h]
  __int128 v9; // [xsp+30h] [xbp-50h]
  char v10[28]; // [xsp+40h] [xbp-40h]
  __int64 v11; // [xsp+68h] [xbp-18h]

  v1 = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
  v2 = (signed int)this;
  v11 = *(_QWORD *)(v1 + 40);
  *(_OWORD *)&v10[12] = 0u;
  v9 = 0u;
  *(_OWORD *)v10 = 0u;
  v7 = 0u;
  v8 = 0u;
  v6 = 0u;
  property_get("ro.flyme.root.state", &v6, "0");
  v3 = strtoul(&v6, 0LL, 10LL);
  if ( v2 != 1 || v3 != 1 )
  {
    *(_OWORD *)&v10[12] = 0u;
    v9 = 0u;
    *(_OWORD *)v10 = 0u;
    v7 = 0u;
    v8 = 0u;
    v6 = 0u;
    property_get("ro.flyme.root.state", &v6, "0");
    v4 = (v2 == 2) & ((unsigned int)strtoul(&v6, 0LL, 10LL) != 1);
  }
  else
  {
    v4 = 1;
  }
  result = __android_log_print(3LL, "DeviceStateService", "doCheckRootStateRpmb: the result is: %d", v4);
  if ( *(_QWORD *)(v1 + 40) == v11 )
    result = v4;
  return result;
}

__int64 __fastcall android::doCheckLockStateRpmb(android *this)
{
  unsigned __int64 v1; // x21
  int v2; // w19
  __int64 v3; // x0
  unsigned int v4; // w20
  unsigned int v5; // w19
  __int64 result; // x0
  unsigned int *v7; // x0
  __int128 v8; // [xsp+0h] [xbp-130h]
  __int128 v9; // [xsp+10h] [xbp-120h]
  __int128 v10; // [xsp+20h] [xbp-110h]
  __int128 v11; // [xsp+30h] [xbp-100h]
  char v12[28]; // [xsp+40h] [xbp-F0h]
  __int64 v13; // [xsp+108h] [xbp-28h]

  v1 = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
  v2 = (signed int)this;
  v13 = *(_QWORD *)(v1 + 40);
  *(_OWORD *)&v12[12] = 0u;
  v11 = 0u;
  *(_OWORD *)v12 = 0u;
  v9 = 0u;
  v10 = 0u;
  v8 = 0u;
  //测试魅族17  返回值-4
  property_get("ro.flyme.device.legal", &v8, "0");
  if ( strtoul(&v8, 0LL, 10LL) & 0x80000000 )
  {
    result = __android_log_print(3LL, "DeviceStateService", "doCheckLockStateRpmb: the device is not legal!");
    v5 = 1;
  }
  else
  {
    // 实测魅族17 无法打开这个文件
    v3 = __open_2("/dev/mz_rpmb_ctl", 2LL);
    if ( v3 & 0x80000000 )
    {
      v7 = (unsigned int *)__errno();
      result = __android_log_print(3LL, "DeviceStateService", "doCheckLockStateRpmb: open rpmb failed, errno=%d\n", *v7);
      v5 = -1;
    }
    else
    {
      v4 = v3;
      LODWORD(v8) = 559286153;
      if ( ioctl(v3) & 0x80000000 && DWORD1(v8) & 0x80000000 )
      {
        result = __android_log_print(3LL, "DeviceStateService", "doCheckLockStateRpmb: ioctl failed!");
        v5 = -1;
      }
      else
      {
        if ( (v2 != 3 || DWORD2(v8) != 626460454) && (v2 != 4 || DWORD2(v8) != 626460453) )
        {
          if ( DWORD2(v8) == 626460450 )
            v5 = 0;
          else
            v5 = -1;
        }
        else
        {
          v5 = 1;
        }
        close(v4);
        result = __android_log_print(3LL, "DeviceStateService", "doCheckLockStateRpmb: the result is: %d", v5);
      }
    }
  }
  if ( *(_QWORD *)(v1 + 40) == v13 )
    result = v5;
  return result;
}

[info]systemui中的相关方法基于17p 8.1.2.2[/info]

    private boolean isLossMode() {
        if(this.mDeviceStateManager != null && (this.mDeviceStateManager.doCheckState(DeviceStateManager.RemoteHandle.Lock.ordinal()) == 1 || this.mDeviceStateManager.doCheckState(DeviceStateManager.RemoteHandle.Lock_Report_Loss.ordinal()) == 1)) {
            Log.v(this.TAG, "isLossMode");
            return 1;
        }

        return 0;
    }

    public boolean lossMode() {
        if(this.mDeviceStateManager != null && (this.mDeviceStateManager.doCheckState(DeviceStateManager.RemoteHandle.Lock.ordinal()) == 1 || this.mDeviceStateManager.doCheckState(DeviceStateManager.RemoteHandle.Lock_Report_Loss.ordinal()) == 1)) {
            Log.v("SystemModeUtils", "FindPhone is lossMode");
            return 1;
        }

        return 0;
    }

我们可以看到丢失模式都是调用doCheckState处理的
且判断丢失模式的方法定义比较多哪里都有修改 doCheckState比较合适

经过研究直接修改 libanddroid_services.so中的doCheckLockStateRpmb方法，直接二进制修改字符串/dev/mz_rpmb_ctl实现起来难度低，稳定性好

后续:
直接修改so能破锁定，但似乎还有其他的策略，联网一段时间后还是会被远程服务器锁定。所以doCheckState lossMode也需要改

Flyme系统解锁后强制进入丢失模式

Flyme助手问题反馈手机

Flyme助手使用手册和激活付费相关

Flyme助手问题反馈手机

Flyme助手 使用手册和激活付费相关

Flyme助手使用手册和激活付费相关