Fixes for OP6

BrokenPen · Jul 4, 2018 · efdde65 · efdde65
1 parent 9eba555
commit efdde65
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 5 deletions.
diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 Oppo/Oneplus .ops Firmware decrypter
 ------------------------------------
 
-Tested with "MSMDownloadTool V4.0" for Oneplus 5, Frida 10.4 and Windoze
+Tested with "MSMDownloadTool V4.0" for Oneplus 5/6, Frida >10.4 and Windoze
 
 * backdoor.py : Enables hidden "readback" functionality
 * decrypt.py  : Decrypts any part of the firmware

diff --git a/decrypt.py b/decrypt.py
@@ -94,15 +94,16 @@ def main(target_process, start, length):
                             // When function is called, print out its parameters
                             onEnter: function (args) {
                                 console.log('');
-                                console.log('[+] Length: ' + args[0]);
-                                console.log('[+] EDI: ' + Memory.readU32(this.context.edi).toString(16)); // Plaintext
+                                console.log('[+] AES-Length: ' + args[0]);
+                                console.log('[+] AES-EDX: ' + Memory.readU32(this.context.edx).toString(16)); // Plaintext
                                 this.length=args[0].toInt32();
+                                this.xx=this.context.edx;
                             },
 
                             // When function is finished
                             onLeave: function (retval) {
-                                dumpAddr('Data', this.context.edi, 16); // Print out data array, which will contain de/encrypted data as output
-                                dt=Memory.readByteArray(this.context.edi,this.length);
+                                dumpAddr('Data', this.xx, 16); // Print out data array, which will contain de/encrypted data as output
+                                dt=Memory.readByteArray(this.xx,this.length);
                                 send('Output',dt);
                                 console.log("Writing data.");
                             }