19-03-2022, 11:20 AM
Hello everyone,
I had the same problem than everybody, and with small reverse engineering (Ghidra), I found out the new value, it's :
08B5****7B441B681B680122B, so 08B5****7B441B681B68022B.
The reason is quite simple, it's because the patch prevented a function, which checked if the device could be trusted, from working by making it directly return 0. But, since (probably) Android 10, the function changed a little bit, and the binary code did so (here, it's a variable, 'state', I think, that is compared to 0x02 were it was to 0x01 before).
The same patch works perfectly, so:
If device is less than android 10:
- Dump lk.img, mtkclient works perfectly, but other tools may also work (not for me)
- Locate 08B5****7B441B681B68012B.
- Change the first 6 bytes to 08B5002008BD, so 08B5002008BD1B681B68012B
- Flash lk.img using
Code:
fastboot flash lk lk.img
Else:
- Same
- Locate 08B5****7B441B681B68022B.
- Same, so 08B5002008BD1B681B68022B.
- Same
Since it prevent the function from running, the text (at least for 'Orange state' case) should disappear.
I, or Hovatek forum can't be taken as responsible if you damage your phone.
/* Do it at your own risks */