[CLOSED]🔥World-First FREE Offline Oppo & OnePlus & Realme VIP Workaround in EDL mode has arrived!

rasheed9999 · Saturday at 7:30 AM

Announcement: Free Offline Read/Write Access for OPPO, Realme, and OnePlus Devices

In light of the recent paid update from the Chimera Tool, I am excited to share a significant development with the community.

I have acquired the necessary files to enable free, offline read and write operations on a wide range of OPPO, Realme, and OnePlus devices. This access is achieved via the Firehose mode, allowing for low-level communication with the device's storage.

Supported Platforms/Processors:

Snapdragon 8 Elite
Snapdragon 8 Gen 4, 8 Gen 3, 8 Gen 2, 8 Gen 1, 8+ Gen 1
Snapdragon 7+ Gen 3
Snapdragon 888, 695, 710, 765G, 845
Snapdragon 6s Gen 3, 460, 662
...and more.

By using these files with compatible open-source tools, you can now freely read from and write to your device's partitions without an internet connection.

GitHub Repository & Tool:
You can find the necessary files and tool here:
{Mod edit: Link removed}

Feel free to explore, contribute, and use this resource to its full potential.

Tips: if not have digest and sign file in the folder, just send programmer,then you can flash now!

chimera log:
{Mod edit: Link removed}

Renate · Saturday at 8:16 AM

That's very nice.

"OPPO_710_670_712_New_Chimera.elf" is a Motorola Firehose and not for Oppo but can be found at:
https://github.com/bkerler/Loaders/...a/000910e100010000_13d7a19aeb74fb1c_fhprg.bin

"OPPO_SM8350_New_Chimera_V2.6.elf" is a good Oppo Firehose but is known and can be found at:
https://github.com/bkerler/Loaders/blob/main/oppo/prog_firehose_ddr.elf

The other eleven look good and were not previously known.

rasheed9999 · Saturday at 8:23 AM

Renate said:
That's very nice.

"OPPO_710_670_712_New_Chimera.elf" is a Motorola Firehose and not for Oppo but can be found at:
https://github.com/bkerler/Loaders/...a/000910e100010000_13d7a19aeb74fb1c_fhprg.bin

"OPPO_SM8350_New_Chimera_V2.6.elf" is a good Oppo Firehose but is known and can be found at:
https://github.com/bkerler/Loaders/blob/main/oppo/prog_firehose_ddr.elf

The other eleven look good and were not previously known.

Yes, basically all the files come from OPPO's official tools, but the key lies in the Digest and Sign files. These files help us bypass VIP authentication, allowing direct execution of all commands such as program read.

binary**# · Saturday at 8:31 AM

hey mate, thanks for sharing this excellent resource.
However, can you help me with this. I can boot my OnePlus to EDL mode. And I'm seeing some batch files that needs to be run. But it wouldn't be that simple, right? What else do I need to do to use this tool?

Thanks in advance

rasheed9999 · Saturday at 8:38 AM

binary**# said:
hey mate, thanks for sharing this excellent resource.
However, can you help me with this. I can boot my OnePlus to EDL mode. And I'm seeing some batch files that needs to be run. But it wouldn't be that simple, right? What else do I need to do to use this tool?

Thanks in advance

The general process is as follows:

First, run "1.Enter_firehose_mode.bat".
Then, enter the file paths for the Programmer, Digest, and Sign files.
Next, boot the phone into EDL mode. The tool will then automatically connect and bypass the VIP authentication.

After seeing the done prompt, you can run "2.Read_by_xml.bat".
Then, enter the path to the XML file (rawprogram.xml) and press Enter.
After that, type 'y' and press enter. and the program will automatically backup the partitions listed in the XML.

The writing process follows the same principle.

POLMoto · Saturday at 8:42 AM

Witajcie, ja potrzebuję plików Firehose do Moto G30 XT2129-2. Telefon Mam w EDL.

Hello, I need Firehose files for Moto G30 XT2129-2. I have the phone in EDL.

binary**# · Saturday at 8:45 AM

thanks mate for your help...trying it out right away...

user0u · Saturday at 8:46 AM

The post mentions Oneplus, but I only see Oppo loaders in the rar file. I imagine there isn't a workaround for Oneplus yet?

Renate · Saturday at 8:46 AM

rasheed9999 said:
The key lies in the Digest and Sign files. These files help us bypass VIP authentication, allowing direct execution of all commands such as program read.

I don't have any experience with these things, but if it can be handled by custom Firehose XML commands then my Windows EDL client should be able to work.

These two Firehoses do not use/support <getsigndata>:

SDM845_New_Chimera.elf
OPPO_765G_765_768G_732_730G_730_678_675_New_Chimera.elf

rasheed9999 · Saturday at 8:47 AM

POLMoto said:
Witajcie, ja potrzebuję plików Firehose do Moto G30 XT2129-2. Telefon Mam w EDL.

Hello, I need Firehose files for Moto G30 XT2129-2. I have the phone in EDL.

I don't have any other files. I can only say these files are from the Chimera tool, and I don't have any others.

rasheed9999 · Saturday at 8:48 AM

user0u said:
The post mentions Oneplus, but I only see Oppo loaders in the rar file. I imagine there isn't a workaround for Oneplus yet?

It works for OPPO, OnePlus, and Realme.

rasheed9999 · Saturday at 8:50 AM

Renate said:
I don't have any experience with these things, but if it can be handled by custom Firehose XML commands then my Windows EDL client should be able to work.

These two Firehoses do not use/support <getsigndata>:

SDM845_New_Chimera.elf

OPPO_765G_765_768G_732_730G_730_678_675_New_Chimera.elf

Yes, you can use edlclient or QFIL, and they will also work for the "OPPO_710_670_712_New_Chimera.elf"

rasheed9999 · Saturday at 8:58 AM

As a developer, I'll briefly outline the VIP bypass process:

1.Send the programmer file
2.Write the digest
3.Send this command:

XML:

<?xml version="1.0" encoding="UTF-8"?><data> <verify value="ping" EnableVip="1"/> </data>

4. Write the sign file
5. After INFO: verify passed prompt appears, send:

XML:

<?xml version="1.0" encoding="UTF-8"?> <data> <sha256init Verbose="1"/> </data>

You can then proceed with other operations.

Note: for program and read commands, you must include both label and filename attributes, otherwise the operation will be blocked.

binary**# · Saturday at 9:21 AM

rasheed9999 said:
enter the path to the XML file (rawprogram.xml)

sorry, mate to keep you bugging, but I have one more query... from where to choose the rawprogram.xml.. In the tool, we have the XML test folder; do we need to select from there? And if yes, how to identify which file corresponds to our chipset [for reference, mine is SM8550 8Gen2]

Renate · Saturday at 9:35 AM

If anybody has this working with digest and signing could you do a full USB capture with WireShark (or Beagle) and post or PM me the .pcap, .pcapng or .csv file?
Just the start from loader, digest, sign and a normal read of a small partition like misc.
Make sure that you have "snap length" set to at least 262144 instead of the default 65535.
Thank you.

rasheed9999 · Saturday at 9:44 AM

binary**# said:
sorry, mate to keep you bugging, but I have one more query... from where to choose the rawprogram.xml.. In the tool, we have the XML test folder; do we need to select from there? And if yes, how to identify which file corresponds to our chipset [for reference, mine is SM8550 8Gen2]

use rawprogram in the firmware

fatalcoder524 · Saturday at 2:33 PM

I can't find bat files or instructions on how to read or flash the whole EDL firmware.

lllyyyz · Saturday at 2:44 PM

rasheed9999 said:
use rawprogram in the firmware

Sorry to bother you, regarding "use rawprogram in the firmware": I found many rawprogram files in the firmware, such as rawprogram0.xml, rawprogram1.xml, etc. Which one should I use?

themuawiyah · Saturday at 2:46 PM

what about snapdragon 8 gen 1 (8450)

themuawiyah · Sunday at 3:10 PM

Renate said:
That's very nice.

"OPPO_710_670_712_New_Chimera.elf" is a Motorola Firehose and not for Oppo but can be found at:
https://github.com/bkerler/Loaders/...a/000910e100010000_13d7a19aeb74fb1c_fhprg.bin

"OPPO_SM8350_New_Chimera_V2.6.elf" is a good Oppo Firehose but is known and can be found at:
https://github.com/bkerler/Loaders/blob/main/oppo/prog_firehose_ddr.elf

The other eleven look good and were not previously known.

do you also have it for SM8450?

[CLOSED]🔥World-First FREE Offline Oppo & OnePlus & Realme VIP Workaround in EDL mode has arrived!

Member

Announcement: Free Offline Read/Write Access for OPPO, Realme, and OnePlus Devices​

Recognized Contributor / Inactive Recognized Dev

Member

Senior Member

Member

New member

Senior Member

Senior Member

Recognized Contributor / Inactive Recognized Dev

Member

Member

Member

Member

Senior Member

Recognized Contributor / Inactive Recognized Dev

Member

Senior Member

Senior Member

Member

Member

Similar threads

Top Liked Posts

Announcement: Free Offline Read/Write Access for OPPO, Realme, and OnePlus Devices​

Announcement: Free Offline Read/Write Access for OPPO, Realme, and OnePlus Devices

Announcement: Free Offline Read/Write Access for OPPO, Realme, and OnePlus Devices