Qualcomm puts a built in recovery mode in every smartphone chipset called EDL or QDL mode (short for emergency download mode) under the already fuarrrkton of firmware modes. This mode is usually when you consider your phone bricked and you can't power it on or go into bootloader or recovery.
This mode accepts XML formatted commands from a file called "firehose" (an ELF64 binary for ARM64) trough USB that is either a prefab made one by qualcomm for the chipset or (most often) a custom made one by the OEM (i.e. Xiaomi).
>EDL exploitation
This mode has vulnerabilities as discussed in https://alephsecurity.com/2018/01/22/qualcomm-edl-1/
>EDL authentication and unbricking
Some phone manufacturers like Xiaomi have built-in authentication inside this firehose. Which means if you somehow get your phone bricked and you get hold of this firehose file you get fuarrrked as the firehose itself asks for "authentification" which is from what i understand a RSA private key specific to the device that Xiaomi wagies get when they click on "flash" on their firmware flasher and are logged in. It seems like the whole authentication process is inside the firehose file itself and not in the phone chipset, but correct me if i'm wrong.
>inb4 modify the firehose and bypass the authentication
This is the problem. The firehoses are supposedly RSA signed and if you change them the loader hangs up or throws errors. It's a mistery how some "patched" firehoses that work with no authentication are released, some say it's leaks from the employees, but many have still yet to be found.
Do you have experience on EDL exploits or EDL patching? Share resources.
Do you have a bricked phone? You might get surprised to find out it's in EDL/QDL 9008 mode if you connect it to usb and look trough your dmesg log or run lsusb.
Links:
>Review on EDL workings and exploitation
https://alephsecurity.com/2018/01/22/qualcomm-edl-1/
>Some already found patched loaders
https://www.temblast.com/ref/loaders.htm
>Custom EDL Loader with some already patched loaders included and other features
https://github.com/bkerler/edl
>Guide on how to view (not patch) a firehose loader with authentication with some reverse engineering toolkit (needs translation)
https://zenlty.medium.com/android-rehberim-qualcomm-loader-reverse-engineering-7e484cc0fb9e
I am just curious how people manage to patch these files so I figured starting a thread might start some useful discussion and even help someone.